suricata
detect.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Basic detection engine
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "decode.h"
30 #include "packet.h"
31 #include "flow.h"
32 #include "stream-tcp.h"
33 #include "app-layer.h"
34 #include "app-layer-parser.h"
35 #include "app-layer-frames.h"
36 
37 #include "detect.h"
38 #include "detect-parse.h"
39 #include "detect-dsize.h"
40 #include "detect-engine.h"
41 #include "detect-engine-build.h"
42 #include "detect-engine-frame.h"
43 #include "detect-engine-profile.h"
44 
45 #include "detect-engine-alert.h"
46 #include "detect-engine-siggroup.h"
47 #include "detect-engine-address.h"
48 #include "detect-engine-proto.h"
49 #include "detect-engine-port.h"
50 #include "detect-engine-mpm.h"
51 #include "detect-engine-iponly.h"
52 #include "detect-engine-threshold.h"
53 #include "detect-engine-prefilter.h"
54 #include "detect-engine-state.h"
55 #include "detect-engine-analyzer.h"
56 
57 #include "detect-engine-payload.h"
58 #include "detect-engine-event.h"
59 
60 #include "detect-filestore.h"
61 #include "detect-flowvar.h"
62 #include "detect-replace.h"
63 
64 #include "util-validate.h"
65 #include "util-detect.h"
66 #include "util-profiling.h"
67 
68 #include "action-globals.h"
69 
70 typedef struct DetectRunScratchpad {
71  const AppProto alproto;
72  const uint8_t flow_flags; /* flow/state flags: STREAM_* */
73  const bool app_decoder_events;
74  const enum DetectFirewallPacketPolicies fw_pkt_policy;
75  const SigGroupHead *sgh;
76 } DetectRunScratchpad;
77 
78 /* prototypes */
79 static DetectRunScratchpad DetectRunSetup(const DetectEngineCtx *de_ctx,
80  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
81  const enum DetectFirewallPacketPolicies fw_pkt_policy);
82 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
83  DetectEngineThreadCtx *det_ctx, Flow * const pflow, Packet * const p);
84 static inline void DetectRunGetRuleGroup(const DetectEngineCtx *de_ctx,
85  Packet * const p, Flow * const pflow, DetectRunScratchpad *scratch);
86 static inline void DetectRunPrefilterPkt(ThreadVars *tv, const DetectEngineCtx *de_ctx,
87  DetectEngineThreadCtx *det_ctx, Packet *p, DetectRunScratchpad *scratch);
88 static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
89  const DetectEngineCtx *const de_ctx, DetectEngineThreadCtx *const det_ctx, Packet *const p,
90  Flow *const pflow, const DetectRunScratchpad *scratch);
91 static void DetectRunTx(ThreadVars *tv, DetectEngineCtx *de_ctx,
92  DetectEngineThreadCtx *det_ctx, Packet *p,
93  Flow *f, DetectRunScratchpad *scratch);
94 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
95  Packet *p, Flow *f, DetectRunScratchpad *scratch);
96 static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_ctx,
97  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
98  DetectRunScratchpad *scratch);
99 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
100  Packet *p, Flow * const pflow);
101 static inline void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet *p);
102 
103 /** \internal
104  */
105 static void DetectRun(ThreadVars *th_v,
106  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
107  Packet *p)
108 {
109  SCEnter();
110  SCLogDebug("pcap_cnt %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
111  p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
112  : "noflow",
113  PktSrcToString(p->pkt_src));
114 
115  /* Load the Packet's flow early, even though it might not be needed.
116  * Mark as a constant pointer, although the flow itself can change. */
117  Flow * const pflow = p->flow;
118 
119  DetectRunScratchpad scratch =
120  DetectRunSetup(de_ctx, det_ctx, p, pflow, DETECT_FIREWALL_POLICY_PACKET_FILTER);
121 
122  /* run the IPonly engine */
123  DetectRunInspectIPOnly(th_v, de_ctx, det_ctx, pflow, p);
124 
125  /* get our rule group */
126  DetectRunGetRuleGroup(de_ctx, p, pflow, &scratch);
127  /* if we didn't get a sig group head, we
128  * have nothing to do.... */
129  if (scratch.sgh == NULL) {
130  if (!EngineModeIsFirewall()) {
131  SCLogDebug("no sgh for this packet, nothing to match against");
132  goto end;
133  }
134  SCLogDebug(
135  "packet %" PRIu64 ": no sgh, need to apply default policies", PcapPacketCntGet(p));
136  } else {
137  /* run the prefilters for packets */
138  DetectRunPrefilterPkt(th_v, de_ctx, det_ctx, p, &scratch);
139  }
140  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES);
141  /* inspect the rules against the packet */
142  const uint8_t pkt_policy = DetectRulePacketRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
143  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
144  SCLogDebug("packet %" PRIu64 ": pkt_policy %02x (p->action %02x)", PcapPacketCntGet(p),
145  pkt_policy, p->action);
146 
147  /* Only FW rules will already have set the action, IDS rules go through PacketAlertFinalize
148  *
149  * If rules told us to drop or accept:packet/accept:flow, we skip app_filter and app_td.
150  *
151  * accept:hook won't have set the pkt_policy, so we simply continue.
152  *
153  * TODO what about app state progression, cleanup and such? */
154  if (pkt_policy & (ACTION_DROP | ACTION_ACCEPT)) {
155  goto end;
156  }
157 
158  /* run tx/state inspection. Don't call for ICMP error msgs. */
159  if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) {
160  if (p->proto == IPPROTO_TCP) {
161  if ((p->flags & PKT_STREAM_EST) == 0) {
162  SCLogDebug("packet %" PRIu64 ": skip tcp non-established", PcapPacketCntGet(p));
163  if (EngineModeIsFirewall()) {
164  SCLogDebug("default accept: no PKT_STREAM_EST");
165  DetectRunAppendDefaultAccept(det_ctx, p);
166  }
167  goto end;
168  }
169  const TcpSession *ssn = p->flow->protoctx;
170  bool setting_nopayload = p->flow->alparser &&
171  SCAppLayerParserStateIssetFlag(
172  p->flow->alparser, APP_LAYER_PARSER_NO_INSPECTION) &&
173  !(p->flags & PKT_NOPAYLOAD_INSPECTION);
174  // we may be right after disabling app-layer (ssh)
175  if (ssn &&
176  ((ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) == 0 || setting_nopayload)) {
177  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
178  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
179  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);
180  }
181  // no update to transactions
182  if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 &&
183  ((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) ||
184  (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) {
185  SCLogDebug("packet %" PRIu64 ": no app-layer update", PcapPacketCntGet(p));
186  if (EngineModeIsFirewall()) {
187  SCLogDebug("default accept: no app update");
188  DetectRunAppendDefaultAccept(det_ctx, p);
189  }
190  goto end;
191  }
192  } else if (p->proto == IPPROTO_UDP) {
193  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
194  }
195 
196  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
197  DetectRunTx(th_v, de_ctx, det_ctx, p, pflow, &scratch);
198  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);
199  /* see if we need to increment the inspect_id and reset the de_state */
200  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX_UPDATE);
201  AppLayerParserSetTransactionInspectId(
202  pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL));
203  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE);
204  } else {
205  SCLogDebug("packet %" PRIu64 ": no flow / app-layer", PcapPacketCntGet(p));
206  if (EngineModeIsFirewall()) {
207  SCLogDebug("default accept: no flow/app");
208  DetectRunAppendDefaultAccept(det_ctx, p);
209  }
210  }
211 
212 end:
213  DetectRunPostRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
214 
215  DetectRunCleanup(det_ctx, p, pflow);
216  SCReturn;
217 }
218 
219 /** \internal
220  */
221 static void DetectRunPacketHook(ThreadVars *th_v, const DetectEngineCtx *de_ctx,
222  DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
223  enum DetectFirewallPacketPolicies fw_pkt_policy)
224 {
225  SCEnter();
226  SCLogDebug("pcap_cnt %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
227  p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
228  : "noflow",
229  PktSrcToString(p->pkt_src));
230 
231  /* Load the Packet's flow early, even though it might not be needed.
232  * Mark as a constant pointer, although the flow itself can change. */
233  Flow *const pflow = p->flow;
234 
235  DetectRunScratchpad scratch = DetectRunSetup(de_ctx, det_ctx, p, pflow, fw_pkt_policy);
236  scratch.sgh = sgh;
237 
238  /* if we didn't get a sig group head, we
239  * have nothing to do.... */
240  if (scratch.sgh == NULL) {
241  SCLogDebug("no sgh for this packet, nothing to match against");
242  goto end;
243  }
244 
245  /* run the prefilters for packets */
246  DetectRunPrefilterPkt(th_v, de_ctx, det_ctx, p, &scratch);
247 
248  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES); // TODO
249  /* inspect the rules against the packet */
250  const uint8_t pkt_policy = DetectRulePacketRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
251  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
252  if (pkt_policy & (ACTION_DROP | ACTION_ACCEPT)) {
253  goto end;
254  }
255 
256 end:
257  DetectRunPostRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
258 
259  DetectRunCleanup(det_ctx, p, pflow);
260  SCReturn;
261 }
262 
263 static void DetectRunPostMatch(ThreadVars *tv,
264  DetectEngineThreadCtx *det_ctx, Packet *p,
265  const Signature *s)
266 {
267  /* run the packet match functions */
268  const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_POSTMATCH];
269  if (smd != NULL) {
270  KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_POSTMATCH);
271 
272  SCLogDebug("running match functions, sm %p", smd);
273 
274  while (1) {
275  KEYWORD_PROFILING_START;
276  (void)sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx);
277  KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
278  if (smd->is_last)
279  break;
280  smd++;
281  }
282  }
283 }
284 
285 /**
286  * \brief Get the SigGroupHead for a packet.
287  *
288  * \param de_ctx detection engine context
289  * \param p packet
290  *
291  * \retval sgh the SigGroupHead or NULL if non applies to the packet
292  */
293 const SigGroupHead *SigMatchSignaturesGetSgh(const DetectEngineCtx *de_ctx,
294  const Packet *p)
295 {
296  SCEnter();
297  SigGroupHead *sgh = NULL;
298 
299  /* use ethernet non-IP sgh if we're ethernet but have no (valid) IP layer on top of it. */
300  if (PacketIsEthernet(p) && p->proto == 0 && de_ctx->eth_non_ip_sgh != NULL) {
301  SCLogDebug("using eth_non_ip_sgh %p", de_ctx->eth_non_ip_sgh);
302  SCReturnPtr(de_ctx->eth_non_ip_sgh, "SigGroupHead");
303  }
304 
305  /* if the packet proto is 0 (not set), we're inspecting it against
306  * the decoder events sgh we have. */
307  if (p->proto == 0 && p->events.cnt > 0) {
308  SCReturnPtr(de_ctx->decoder_event_sgh, "SigGroupHead");
309  } else if (p->proto == 0) {
310  if (!(PacketIsIPv4(p) || PacketIsIPv6(p))) {
311  /* not IP, so nothing to do */
312  SCReturnPtr(NULL, "SigGroupHead");
313  }
314  }
315 
316  /* select the flow_gh */
317  const int dir = (p->flowflags & FLOW_PKT_TOCLIENT) == 0;
318 
319  int proto = PacketGetIPProto(p);
320  if (proto == IPPROTO_TCP) {
321  DetectPort *list = de_ctx->flow_gh[dir].tcp;
322  SCLogDebug("tcp toserver %p, tcp toclient %p: going to use %p", de_ctx->flow_gh[1].tcp,
323  de_ctx->flow_gh[0].tcp, de_ctx->flow_gh[dir].tcp);
324  const uint16_t port = dir ? p->dp : p->sp;
325  SCLogDebug("tcp port %u -> %u:%u", port, p->sp, p->dp);
326  DetectPort *sghport = DetectPortLookupGroup(list, port);
327  if (sghport != NULL)
328  sgh = sghport->sh;
329  SCLogDebug("TCP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
330  dir ? "toserver" : "toclient", sghport, sgh);
331  } else if (proto == IPPROTO_UDP) {
332  DetectPort *list = de_ctx->flow_gh[dir].udp;
333  uint16_t port = dir ? p->dp : p->sp;
334  DetectPort *sghport = DetectPortLookupGroup(list, port);
335  if (sghport != NULL)
336  sgh = sghport->sh;
337  SCLogDebug("UDP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
338  dir ? "toserver" : "toclient", sghport, sgh);
339  } else {
340  sgh = de_ctx->flow_gh[dir].sgh[proto];
341  }
342 
343  SCReturnPtr(sgh, "SigGroupHead");
344 }
345 
346 static inline void DetectPrefilterCopyDeDup(
347  const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
348 {
349  SigIntId *pf_ptr = det_ctx->pmq.rule_id_array;
350  uint32_t final_cnt = det_ctx->pmq.rule_id_array_cnt;
351  Signature **sig_array = de_ctx->sig_array;
352  Signature **match_array = det_ctx->match_array;
353  SigIntId previous_id = (SigIntId)-1;
354  while (final_cnt-- > 0) {
355  SigIntId id = *pf_ptr++;
356  Signature *s = sig_array[id];
357 
358  /* As the prefilter list can contain duplicates, check for that here. */
359  if (likely(id != previous_id)) {
360  *match_array++ = s;
361  previous_id = id;
362  }
363  }
364 
365  det_ctx->match_array_cnt = (uint32_t)(match_array - det_ctx->match_array);
366  DEBUG_VALIDATE_BUG_ON(det_ctx->pmq.rule_id_array_cnt < det_ctx->match_array_cnt);
367  PMQ_RESET(&det_ctx->pmq);
368 }
369 
370 /** \internal
371  * \brief update flow's file tracking flags based on the detection engine
372  * A set of flags is prepared that is sent to the File API. The
373  File API may reject one or more based on the global force settings.
374  */
375 static inline void
376 DetectPostInspectFileFlagsUpdate(Flow *f, const SigGroupHead *sgh, uint8_t direction)
377 {
378  uint16_t flow_file_flags = FLOWFILE_INIT;
379 
380  if (sgh == NULL) {
381  SCLogDebug("requesting disabling all file features for flow");
382  flow_file_flags = FLOWFILE_NONE;
383  } else {
384  if (sgh->filestore_cnt == 0) {
385  SCLogDebug("requesting disabling filestore for flow");
386  flow_file_flags |= (FLOWFILE_NO_STORE_TS|FLOWFILE_NO_STORE_TC);
387  }
388 #ifdef HAVE_MAGIC
389  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)) {
390  SCLogDebug("requesting disabling magic for flow");
391  flow_file_flags |= (FLOWFILE_NO_MAGIC_TS|FLOWFILE_NO_MAGIC_TC);
392  }
393 #endif
394  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMD5)) {
395  SCLogDebug("requesting disabling md5 for flow");
396  flow_file_flags |= (FLOWFILE_NO_MD5_TS|FLOWFILE_NO_MD5_TC);
397  }
398  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA1)) {
399  SCLogDebug("requesting disabling sha1 for flow");
400  flow_file_flags |= (FLOWFILE_NO_SHA1_TS|FLOWFILE_NO_SHA1_TC);
401  }
402  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA256)) {
403  SCLogDebug("requesting disabling sha256 for flow");
404  flow_file_flags |= (FLOWFILE_NO_SHA256_TS|FLOWFILE_NO_SHA256_TC);
405  }
406  }
407  if (flow_file_flags != 0) {
408  FileUpdateFlowFileFlags(f, flow_file_flags, direction);
409  }
410 }
411 
412 static inline void
413 DetectRunPostGetFirstRuleGroup(const Packet *p, Flow *pflow, const SigGroupHead *sgh)
414 {
415  if ((p->flowflags & FLOW_PKT_TOSERVER) && !(pflow->flags & FLOW_SGH_TOSERVER)) {
416  /* first time we see this toserver sgh, store it */
417  pflow->sgh_toserver = sgh;
418  pflow->flags |= FLOW_SGH_TOSERVER;
419 
420  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
421  if (pflow->protoctx != NULL) {
422  TcpSession *ssn = pflow->protoctx;
423  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.client");
424  ssn->client.flags |= STREAMTCP_STREAM_FLAG_DISABLE_RAW;
425  }
426  }
427 
428  DetectPostInspectFileFlagsUpdate(pflow,
429  pflow->sgh_toserver, STREAM_TOSERVER);
430 
431  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && !(pflow->flags & FLOW_SGH_TOCLIENT)) {
432  pflow->sgh_toclient = sgh;
433  pflow->flags |= FLOW_SGH_TOCLIENT;
434 
435  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
436  if (pflow->protoctx != NULL) {
437  TcpSession *ssn = pflow->protoctx;
438  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.server");
439  ssn->server.flags |= STREAMTCP_STREAM_FLAG_DISABLE_RAW;
440  }
441  }
442 
443  DetectPostInspectFileFlagsUpdate(pflow,
444  pflow->sgh_toclient, STREAM_TOCLIENT);
445  }
446 }
447 
448 static inline void DetectRunGetRuleGroup(
449  const DetectEngineCtx *de_ctx,
450  Packet * const p, Flow * const pflow,
451  DetectRunScratchpad *scratch)
452 {
453  const SigGroupHead *sgh = NULL;
454 
455  if (pflow) {
456  bool use_flow_sgh = false;
457  /* Get the stored sgh from the flow (if any). Make sure we're not using
458  * the sgh for icmp error packets part of the same stream. */
459  if (PacketGetIPProto(p) == pflow->proto) { /* filter out icmp */
460  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
461  if ((p->flowflags & FLOW_PKT_TOSERVER) && (pflow->flags & FLOW_SGH_TOSERVER)) {
462  sgh = pflow->sgh_toserver;
463  SCLogDebug("sgh = pflow->sgh_toserver; => %p", sgh);
464  use_flow_sgh = true;
465  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && (pflow->flags & FLOW_SGH_TOCLIENT)) {
466  sgh = pflow->sgh_toclient;
467  SCLogDebug("sgh = pflow->sgh_toclient; => %p", sgh);
468  use_flow_sgh = true;
469  }
470  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
471  }
472 
473  if (!(use_flow_sgh)) {
474  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
475  sgh = SigMatchSignaturesGetSgh(de_ctx, p);
476  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
477 
478  /* HACK: prevent the wrong sgh (or NULL) from being stored in the
479  * flow's sgh pointers */
480  if (PacketIsICMPv4(p) && ICMPV4_DEST_UNREACH_IS_VALID(p)) {
481  ; /* no-op */
482  } else {
483  /* store the found sgh (or NULL) in the flow to save us
484  * from looking it up again for the next packet.
485  * Also run other tasks */
486  DetectRunPostGetFirstRuleGroup(p, pflow, sgh);
487  }
488  }
489  } else { /* p->flags & PKT_HAS_FLOW */
490  /* no flow */
491 
492  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
493  sgh = SigMatchSignaturesGetSgh(de_ctx, p);
494  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
495  }
496 
497  scratch->sgh = sgh;
498 }
499 
500 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
501  DetectEngineThreadCtx *det_ctx,
502  Flow * const pflow, Packet * const p)
503 {
504  if (pflow) {
505  if (p->flowflags & (FLOW_PKT_TOSERVER_FIRST | FLOW_PKT_TOCLIENT_FIRST)) {
506  SCLogDebug("testing against \"ip-only\" signatures");
507 
508  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
509  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
510  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
511  }
512  } else { /* p->flags & PKT_HAS_FLOW */
513  /* no flow */
514 
515  /* Even without flow we should match the packet src/dst */
516  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
517  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
518  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
519  }
520 }
521 
522 /** \internal
523  * \brief inspect the rule header: protocol, ports, etc
524  * \retval bool false if no match, true if match */
525 static inline bool DetectRunInspectRuleHeader(
526  const Packet *p, const Flow *f, const Signature *s, const uint32_t sflags)
527 {
528  /* check if this signature has a requirement for flowvars of some type
529  * and if so, if we actually have any in the flow. If not, the sig
530  * can't match and we skip it. */
531  if ((p->flags & PKT_HAS_FLOW) && (sflags & SIG_FLAG_REQUIRE_FLOWVAR)) {
532  DEBUG_VALIDATE_BUG_ON(f == NULL);
533 
534  /* no flowvars? skip this sig */
535  const bool fv = f->flowvar != NULL;
536  if (!fv) {
537  SCLogDebug("skipping sig as the flow has no flowvars and sig "
538  "has SIG_FLAG_REQUIRE_FLOWVAR flag set.");
539  return false;
540  }
541  }
542 
543  if (!(s->proto == NULL)) {
544  const uint8_t s_proto_flags = s->proto->flags;
545  /* TODO does it make sense to move these flags to s->flags? */
546  if ((s_proto_flags & DETECT_PROTO_IPV4) && !PacketIsIPv4(p)) {
547  SCLogDebug("ip version didn't match");
548  return false;
549  }
550  if ((s_proto_flags & DETECT_PROTO_IPV6) && !PacketIsIPv6(p)) {
551  SCLogDebug("ip version didn't match");
552  return false;
553  }
554  if (DetectProtoContainsProto(s->proto, PacketGetIPProto(p)) == 0) {
555  SCLogDebug("proto didn't match");
556  if (PacketIsEthernet(p) &&
557  (s_proto_flags & (DETECT_PROTO_ETHERNET | DETECT_PROTO_ARP))) {
558  SCLogDebug("checking ether/arp protocol");
559  if ((s_proto_flags & DETECT_PROTO_ARP) && !PacketIsARP(p)) {
560  return false;
561  }
562  SCLogDebug("checking eth protocol: match!");
563  } else {
564  return false;
565  }
566  }
567  }
568 
569  /* check the source & dst port in the sig */
570  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
571  if (!(sflags & SIG_FLAG_DP_ANY)) {
572  if (p->flags & PKT_IS_FRAGMENT)
573  return false;
574  const DetectPort *dport = DetectPortLookupGroup(s->dp, p->dp);
575  if (dport == NULL) {
576  SCLogDebug("dport didn't match.");
577  return false;
578  }
579  }
580  if (!(sflags & SIG_FLAG_SP_ANY)) {
581  if (p->flags & PKT_IS_FRAGMENT)
582  return false;
583  const DetectPort *sport = DetectPortLookupGroup(s->sp, p->sp);
584  if (sport == NULL) {
585  SCLogDebug("sport didn't match.");
586  return false;
587  }
588  }
589  } else if ((sflags & (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) != (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) {
590  SCLogDebug("port-less protocol and sig needs ports");
591  return false;
592  }
593 
594  /* check the destination address */
595  if (!(sflags & SIG_FLAG_DST_ANY)) {
596  if (PacketIsIPv4(p)) {
597  if (DetectAddressMatchIPv4(s->addr_dst_match4, s->addr_dst_match4_cnt, &p->dst) == 0)
598  return false;
599  } else if (PacketIsIPv6(p)) {
600  if (DetectAddressMatchIPv6(s->addr_dst_match6, s->addr_dst_match6_cnt, &p->dst) == 0)
601  return false;
602  }
603  }
604  /* check the source address */
605  if (!(sflags & SIG_FLAG_SRC_ANY)) {
606  if (PacketIsIPv4(p)) {
607  if (DetectAddressMatchIPv4(s->addr_src_match4, s->addr_src_match4_cnt, &p->src) == 0)
608  return false;
609  } else if (PacketIsIPv6(p)) {
610  if (DetectAddressMatchIPv6(s->addr_src_match6, s->addr_src_match6_cnt, &p->src) == 0)
611  return false;
612  }
613  }
614 
615  return true;
616 }
617 
618 /** \internal
619  * \brief run packet/stream prefilter engines
620  */
621 static inline void DetectRunPrefilterPkt(ThreadVars *tv, const DetectEngineCtx *de_ctx,
622  DetectEngineThreadCtx *det_ctx, Packet *p, DetectRunScratchpad *scratch)
623 {
624  /* create our prefilter mask */
625  PacketCreateMask(p, &p->sig_mask, scratch->alproto, scratch->app_decoder_events);
626  /* run the prefilter engines */
627  Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags, p->sig_mask);
628  /* create match list if we have non-pf and/or pf */
629  if (det_ctx->pmq.rule_id_array_cnt) {
630 #ifdef PROFILING
631  if (tv) {
632  StatsCounterAvgAddI64(
633  &tv->stats, det_ctx->counter_mpm_list, (int64_t)det_ctx->pmq.rule_id_array_cnt);
634  }
635 #endif
636  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
637  DetectPrefilterCopyDeDup(de_ctx, det_ctx);
638  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
639  }
640 }
641 
642 /** \internal
643  * \brief check if the tx whose id is given is the only one
644  * live transaction for the flow in the given direction
645  *
646  * \param f flow
647  * \param txid transaction id
648  * \param dir direction
649  *
650  * \retval bool true if we are sure this tx is the only one live in said direction
651  */
652 static bool IsOnlyTxInDirection(Flow *f, uint64_t txid, uint8_t dir)
653 {
654  uint64_t tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
655  if (tx_cnt == txid + 1) {
656  // only live tx
657  return true;
658  }
659  if (tx_cnt == txid + 2) {
660  // 2 live txs, one after us
661  void *tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, txid + 1);
662  if (tx) {
663  AppLayerTxData *txd = AppLayerParserGetTxData(f->proto, f->alproto, tx);
664  // test if the other tx is unidirectional in the other way
665  if ((dir == STREAM_TOSERVER && (txd->flags & APP_LAYER_TX_SKIP_INSPECT_TS)) ||
666  (dir == STREAM_TOCLIENT && (txd->flags & APP_LAYER_TX_SKIP_INSPECT_TC))) {
667  return true;
668  }
669  }
670  }
671  return false;
672 }
673 
674 static int SortHelper(const void *a, const void *b)
675 {
676  const Signature *sa = *(const Signature **)a;
677  const Signature *sb = *(const Signature **)b;
678  if (sa->iid == sb->iid)
679  return 0;
680  return sa->iid > sb->iid ? 1 : -1;
681 }
682 
683 static inline bool SkipFwRules(const Packet *p)
684 {
685  if (p->flow != NULL) {
686  return (p->flow->flags & FLOW_ACTION_ACCEPT) != 0;
687  }
688  return false;
689 }
690 
691 /**
692  * \internal
693  * \brief apply packet default policy
694  * \param[in] de_ctx detect engine, for looking up the policy
695  * \param[in] policy policy to apply
696  * \param[in] p packet to apply policy to
697  * \param[in] final see if we need to apply accept:hook to the packet
698  * \retval action action to immediately apply, accept:hook will not set this unless final is true
699  *
700  * If this is run from the post-match final check, we need to apply a
701  * packet:filter accept:hook to the packet as well.
702  */
703 static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
704  DetectEngineThreadCtx *det_ctx, const enum DetectFirewallPacketPolicies policy, Packet *p,
705  const bool final)
706 {
707  DEBUG_VALIDATE_BUG_ON(de_ctx->fw_policies == NULL);
708  const struct DetectFirewallPolicy *pol = &de_ctx->fw_policies->pkt[policy];
709  if (pol->action & ACTION_DROP) {
710  SCLogDebug("packet %" PRIu64 ": drop PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY",
711  PcapPacketCntGet(p));
712  PacketDrop(p, pol->action, PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY);
713  } else if (pol->action & ACTION_ACCEPT) {
714  SCLogDebug("packet %" PRIu64 ": accept", PcapPacketCntGet(p));
715  if (pol->action_scope == ACTION_SCOPE_PACKET) {
716  p->action |= pol->action;
717  SCLogDebug("packet %" PRIu64 ": accept scope packet", PcapPacketCntGet(p));
718  } else if (pol->action_scope == ACTION_SCOPE_HOOK) {
719  SCLogDebug("packet %" PRIu64 ": accept scope hook", PcapPacketCntGet(p));
720  if (final) {
721  p->action |= pol->action;
722  SCLogDebug("packet %" PRIu64 ": accept scope hook upgraded to packet",
723  PcapPacketCntGet(p));
724  }
725  } else if (pol->action_scope == ACTION_SCOPE_FLOW) {
726  p->action |= pol->action;
727  SCLogDebug("packet %" PRIu64 ": accept scope flow", PcapPacketCntGet(p));
728  if (p->flow) {
729  p->flow->flags |= FLOW_ACTION_ACCEPT;
730  }
731  } else {
732  /* should be unreachable */
733  DEBUG_VALIDATE_BUG_ON(1);
734  }
735  } else {
736  /* should be unreachable */
737  DEBUG_VALIDATE_BUG_ON(1);
738  }
739  Signature *s = de_ctx->fw_policies->pkt_policy_signatures[policy];
740  if (s != NULL) {
741  AlertQueueAppendPacket(det_ctx, s, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
742  }
743  return p->action;
744 }
745 
746 /** \internal
747  * \brief helper for appending a packet alert
748  * Tries to find (guess) a TX to add to the alert.
749  */
750 static void DetectRulePacketAppendAlert(const DetectEngineCtx *de_ctx,
751  DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, Flow *f,
752  const uint8_t alert_flags_in)
753 {
754  DEBUG_VALIDATE_BUG_ON(alert_flags_in & PACKET_ALERT_FLAG_TX);
755 
756  if (f && f->alstate) {
757  const uint8_t dir = (p->flowflags & FLOW_PKT_TOCLIENT) ? STREAM_TOCLIENT : STREAM_TOSERVER;
758  const uint64_t tx_id = AppLayerParserGetTransactionInspectId(f->alparser, dir);
759  if ((s->alproto != ALPROTO_UNKNOWN && f->proto == IPPROTO_UDP) ||
760  (de_ctx->guess_applayer && IsOnlyTxInDirection(f, tx_id, dir))) {
761  // if there is a UDP specific app-layer signature,
762  // or only one live transaction
763  // try to use the good tx for the packet direction
764  void *tx_ptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, tx_id);
765  AppLayerTxData *txd =
766  tx_ptr ? AppLayerParserGetTxData(f->proto, f->alproto, tx_ptr) : NULL;
767  if (txd && txd->guessed_applayer_logged < de_ctx->guess_applayer_log_limit) {
768  uint8_t alert_flags = alert_flags_in;
769  if (f->proto != IPPROTO_UDP) {
770  alert_flags |= PACKET_ALERT_FLAG_TX_GUESSED;
771  }
772  txd->guessed_applayer_logged++;
773  AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, txd->tx_type, alert_flags);
774  return;
775  }
776  }
777  }
778  AlertQueueAppendPacket(det_ctx, s, p, alert_flags_in);
779 }
780 
781 static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
782  const DetectEngineCtx *const de_ctx, DetectEngineThreadCtx *const det_ctx, Packet *const p,
783  Flow *const pflow, const DetectRunScratchpad *scratch)
784 {
785  uint8_t action = 0;
786  bool fw_verdict = false;
787  const bool have_fw_rules = EngineModeIsFirewall();
788  const Signature *next_s = NULL;
789 
790  /* inspect the sigs against the packet */
791  /* Prefetch the next signature. */
792  SigIntId match_cnt = det_ctx->match_array_cnt;
793 #ifdef PROFILING
794  if (tv) {
795  StatsCounterAvgAddI64(&tv->stats, det_ctx->counter_match_list, (int64_t)match_cnt);
796  }
797 #endif
798  Signature **match_array = det_ctx->match_array;
799 
800  SGH_PROFILING_RECORD(det_ctx, scratch->sgh);
801 #ifdef PROFILING
802  if (match_cnt >= de_ctx->profile_match_logging_threshold)
803  RulesDumpMatchArray(det_ctx, scratch->sgh, p);
804 #endif
805 
806  bool skip_fw = SkipFwRules(p);
807  uint32_t sflags, next_sflags = 0;
808  if (match_cnt) {
809  next_s = *match_array++;
810  next_sflags = next_s->flags;
811  }
812  while (match_cnt--) {
813  RULE_PROFILING_START(p);
814  bool break_out_of_packet_filter = false;
815  uint8_t alert_flags = 0;
816 #ifdef PROFILE_RULES
817  bool smatch = false; /* signature match */
818 #endif
819  const Signature *s = next_s;
820  sflags = next_sflags;
821  if (match_cnt) {
822  next_s = *match_array++;
823  next_sflags = next_s->flags;
824  }
825 
826  SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", PcapPacketCntGet(p),
827  s->id);
828 
829  /* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */
830  if (s->flags & SIG_FLAG_FIREWALL) {
831  if (skip_fw) {
832  SCLogDebug("skipping firewall rule %u", s->id);
833  goto next;
834  }
835  } else if (have_fw_rules) {
836  /* fw mode, we skip anything after the fw rules if:
837  * - flow pass is set
838  * - packet pass (e.g. exception policy) */
839  if (p->flags & PKT_NOPACKET_INSPECTION ||
840  (pflow != NULL && pflow->flags & (FLOW_ACTION_PASS))) {
841  SCLogDebug("skipping firewall rule %u", s->id);
842  break_out_of_packet_filter = true;
843  goto next;
844  }
845  }
846 
847  if (s->app_inspect != NULL) {
848  goto next; // handle sig in DetectRunTx
849  }
850  if (s->frame_inspect != NULL) {
851  goto next; // handle sig in DetectRunFrame
852  }
853 
854  /* skip pkt sigs for flow end packets */
855  if ((p->flags & PKT_PSEUDO_STREAM_END) != 0 && s->type == SIG_TYPE_PKT)
856  goto next;
857 
858  /* don't run mask check for stateful rules.
859  * There we depend on prefilter */
860  if ((s->mask & p->sig_mask) != s->mask) {
861  SCLogDebug("mask mismatch %x & %x != %x", s->mask, p->sig_mask, s->mask);
862  goto next;
863  }
864 
865  if (SigDsizePrefilter(p, s, sflags))
866  goto next;
867 
868  /* if the sig has alproto and the session as well they should match */
869  if (likely(sflags & SIG_FLAG_APPLAYER)) {
870  if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, scratch->alproto)) {
871  SCLogDebug("alproto mismatch");
872  goto next;
873  }
874  }
875 
876  if (DetectRunInspectRuleHeader(p, pflow, s, sflags) == false) {
877  goto next;
878  }
879 
880  if (!DetectEnginePktInspectionRun(tv, det_ctx, s, pflow, p, &alert_flags)) {
881  goto next;
882  }
883 
884 #ifdef PROFILE_RULES
885  smatch = true;
886 #endif
887  DetectRunPostMatch(tv, det_ctx, p, s);
888 
889  DetectRulePacketAppendAlert(de_ctx, det_ctx, s, p, pflow, alert_flags);
890 
891  if (det_ctx->post_rule_work_queue.len > 0) {
892  /* run post match prefilter engines on work queue */
893  PrefilterPostRuleMatch(det_ctx, scratch->sgh, p, pflow);
894 
895  if (det_ctx->pmq.rule_id_array_cnt > 0) {
896  /* undo "prefetch" */
897  match_array--;
898  SCLogDebug("sig_array_len %u det_ctx->pmq.rule_id_array_cnt %u",
899  de_ctx->sig_array_len, det_ctx->pmq.rule_id_array_cnt);
900  const Signature **r = det_ctx->replace;
901  for (uint32_t x = 0; x < match_cnt; x++) {
902  *r++ = match_array[x];
903  SCLogDebug("appended %u", match_array[x]->id);
904  }
905  /* append the prefilter results, then sort it */
906  for (uint32_t x = 0; x < det_ctx->pmq.rule_id_array_cnt; x++) {
907  SCLogDebug("adding iid %u", det_ctx->pmq.rule_id_array[x]);
908  Signature *ts = de_ctx->sig_array[det_ctx->pmq.rule_id_array[x]];
909  SCLogDebug("adding id %u", ts->id);
910  if (ts->app_inspect == NULL) {
911  *r++ = ts;
912  match_cnt++;
913  }
914  }
915  if (match_cnt > 1) {
916  qsort(det_ctx->replace, match_cnt, sizeof(Signature *), SortHelper);
917  }
918  /* rewrite match_array to include the new additions, and deduplicate
919  * while at it. */
920  Signature **m = match_array;
921  Signature *last_sig = NULL;
922  uint32_t skipped = 0;
923  for (uint32_t x = 0; x < match_cnt; x++) {
924  /* de-duplicate */
925  if (last_sig == *m) {
926  skipped++;
927  continue;
928  }
929  last_sig = *m;
930  *m++ = (Signature *)det_ctx->replace[x];
931  }
932  match_cnt -= skipped;
933  /* prefetch next */
934  next_s = *match_array++;
935  next_sflags = next_s->flags;
936  SCLogDebug("%u rules added", det_ctx->pmq.rule_id_array_cnt);
937  det_ctx->post_rule_work_queue.len = 0;
938  PMQ_RESET(&det_ctx->pmq);
939  }
940  }
941 
942  /* firewall logic in the packet:filter table:
943  * 1. firewall rules preceed the packet:td rules in the list
944  * 2. if no rule issues an accept, we drop
945  * 3. drop is immediate
946  * 4. accept:
947  * - hook: skip rest of fw rules, inspect packet:td rules
948  * - packet: immediate accept, no packet:td or app:* inspect
949  * - flow: as packet, but applied to all future packets in the
950  * flow as well
951  */
952  if (s->flags & SIG_FLAG_FIREWALL) {
953  if (s->action & (ACTION_ACCEPT)) {
954  fw_verdict = true;
955 
956  enum ActionScope as = s->action_scope;
957  if (as == ACTION_SCOPE_HOOK) {
958  /* accept:hook: jump to first TD. Implemented as:
959  * skip until the first TD rule.
960  * Don't update action as we're just continuing to the next hook. */
961  skip_fw = true;
962 
963  } else if (as == ACTION_SCOPE_PACKET) {
964  /* accept:packet: break loop, return accept */
965  action |= s->action;
966  skip_fw = true;
967 
968  } else if (as == ACTION_SCOPE_FLOW) {
969  /* accept:flow: break loop, return accept */
970  action |= s->action;
971  skip_fw = true;
972 
973  /* set immediately, as we're in hook "packet_filter" */
974  if (pflow) {
975  pflow->flags |= FLOW_ACTION_ACCEPT;
976  }
977  }
978  } else if (s->action & ACTION_DROP) {
979  /* apply a drop immediately here */
980  fw_verdict = true;
981  action |= s->action;
982  break_out_of_packet_filter = true;
983  }
984  }
985 next:
986  DetectVarProcessList(det_ctx, pflow, p);
987  DetectReplaceFree(det_ctx);
988  RULE_PROFILING_END(det_ctx, s, smatch, p);
989 
990  /* fw drop means we're done here */
991  if (break_out_of_packet_filter)
992  break;
993 
994  continue;
995  }
996 
997  /* if no rule told us to accept, and no rule explicitly dropped, we invoke the default drop
998  * policy
999  */
1000  if (have_fw_rules) {
1001  if (skip_fw || fw_verdict) {
1002  /* apply fw action */
1003  p->action |= action;
1004  } else {
1005  DEBUG_VALIDATE_BUG_ON(action & ACTION_DROP);
1006  /* non-final call as we may have to consider app-layer still */
1007  action |= DetectRunApplyPacketPolicy(de_ctx, det_ctx, scratch->fw_pkt_policy, p, false);
1008  }
1009  }
1010  return action;
1011 }
1012 
1013 /** \internal
1014  * \param fw_pkt_policy policy to apply to packet rules
1015  */
1016 static DetectRunScratchpad DetectRunSetup(const DetectEngineCtx *de_ctx,
1017  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
1018  const enum DetectFirewallPacketPolicies fw_pkt_policy)
1019 {
1020  AppProto alproto = ALPROTO_UNKNOWN;
1021  uint8_t flow_flags = 0; /* flow/state flags */
1022  bool app_decoder_events = false;
1023 
1024  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_SETUP);
1025 
1026 #ifdef UNITTESTS
1027  if (RunmodeIsUnittests()) {
1028  p->alerts.cnt = 0;
1029  p->alerts.discarded = 0;
1030  p->alerts.suppressed = 0;
1031  }
1032 #endif
1033  det_ctx->filestore_cnt = 0;
1034  det_ctx->base64_decoded_len = 0;
1035  det_ctx->raw_stream_progress = 0;
1036  det_ctx->match_array_cnt = 0;
1037  det_ctx->json_content_len = 0;
1038 
1039  det_ctx->alert_queue_size = 0;
1040  p->alerts.drop.action = 0;
1041  p->alerts.firewall_discarded = 0;
1042 
1043 #ifdef DEBUG
1044  if (p->flags & PKT_STREAM_ADD) {
1045  det_ctx->pkt_stream_add_cnt++;
1046  }
1047 #endif
1048 
1049  /* grab the protocol state we will detect on */
1050  if (p->flags & PKT_HAS_FLOW) {
1051  DEBUG_VALIDATE_BUG_ON(pflow == NULL);
1052 
1053  if (p->flowflags & FLOW_PKT_TOSERVER) {
1054  flow_flags = STREAM_TOSERVER;
1055  SCLogDebug("flag STREAM_TOSERVER set");
1056  } else if (p->flowflags & FLOW_PKT_TOCLIENT) {
1057  flow_flags = STREAM_TOCLIENT;
1058  SCLogDebug("flag STREAM_TOCLIENT set");
1059  }
1060  SCLogDebug("p->flowflags 0x%02x", p->flowflags);
1061 
1062  if (p->flags & PKT_PSEUDO_STREAM_END) {
1063  flow_flags |= STREAM_EOF;
1064  SCLogDebug("STREAM_EOF set");
1065  }
1066 
1067  /* store tenant_id in the flow so that we can use it
1068  * for creating pseudo packets */
1069  if (p->tenant_id > 0 && pflow->tenant_id == 0) {
1070  pflow->tenant_id = p->tenant_id;
1071  }
1072 
1073  /* live ruleswap check for flow updates */
1074  if (pflow->de_ctx_version == 0) {
1075  /* first time this flow is inspected, set id */
1076  pflow->de_ctx_version = de_ctx->version;
1077  } else if (pflow->de_ctx_version != de_ctx->version) {
1078  /* first time we inspect flow with this de_ctx, reset */
1079  pflow->flags &= ~FLOW_SGH_TOSERVER;
1080  pflow->flags &= ~FLOW_SGH_TOCLIENT;
1081  pflow->sgh_toserver = NULL;
1082  pflow->sgh_toclient = NULL;
1083 
1084  pflow->de_ctx_version = de_ctx->version;
1085  SCGenericVarFree(pflow->flowvar);
1086  pflow->flowvar = NULL;
1087 
1088  DetectEngineStateResetTxs(pflow);
1089  }
1090 
1091  /* Retrieve the app layer state and protocol and the tcp reassembled
1092  * stream chunks. */
1093  if ((p->proto == IPPROTO_TCP && (p->flags & PKT_STREAM_EST)) ||
1094  (p->proto == IPPROTO_UDP) ||
1095  (p->proto == IPPROTO_SCTP && (p->flowflags & FLOW_PKT_ESTABLISHED)))
1096  {
1097  /* update flow flags with knowledge on disruptions */
1098  flow_flags = FlowGetDisruptionFlags(pflow, flow_flags);
1099  alproto = SCFlowGetAppProtocol(pflow);
1100  if (p->proto == IPPROTO_TCP && pflow->protoctx &&
1101  StreamReassembleRawHasDataReady(pflow->protoctx, p)) {
1102  p->flags |= PKT_DETECT_HAS_STREAMDATA;
1103  }
1104  SCLogDebug("alproto %u", alproto);
1105  } else {
1106  SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
1107  }
1108 
1109  app_decoder_events = AppLayerParserHasDecoderEvents(pflow->alparser);
1110  }
1111 
1112  DetectRunScratchpad pad = { alproto, flow_flags, app_decoder_events, fw_pkt_policy, NULL };
1113  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_SETUP);
1114  return pad;
1115 }
1116 
1117 static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_ctx,
1118  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
1119  DetectRunScratchpad *scratch)
1120 {
1121  /* so now let's iterate the alerts and remove the ones after a pass rule
1122  * matched (if any). This is done inside PacketAlertFinalize() */
1123  /* PR: installed "tag" keywords are handled after the threshold inspection */
1124 
1125  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_ALERT);
1126  PacketAlertFinalize(de_ctx, det_ctx, p);
1127  if (p->alerts.cnt > 0) {
1128  StatsCounterAddI64(&tv->stats, det_ctx->counter_alerts, (uint64_t)p->alerts.cnt);
1129  }
1130  if (p->alerts.discarded > 0) {
1131  StatsCounterAddI64(
1132  &tv->stats, det_ctx->counter_alerts_overflow, (uint64_t)p->alerts.discarded);
1133  }
1134  if (p->alerts.firewall_discarded > 0) {
1135  StatsCounterAddI64(&tv->stats, det_ctx->counter_firewall_discarded_alerts,
1136  (uint64_t)p->alerts.firewall_discarded);
1137  }
1138  if (p->alerts.suppressed > 0) {
1139  StatsCounterAddI64(
1140  &tv->stats, det_ctx->counter_alerts_suppressed, (uint64_t)p->alerts.suppressed);
1141  }
1142  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_ALERT);
1143 
1144  /* firewall: "fail" closed if we don't have an ACCEPT. This can happen
1145  * if there was no rule group. */
1146  // TODO review packet src types here
1147  if (EngineModeIsFirewall() && ((p->action & (ACTION_ACCEPT | ACTION_DROP)) == 0) &&
1148  p->pkt_src == PKT_SRC_WIRE) {
1149  SCLogDebug("packet %" PRIu64 ": default action as no verdict set %02x (pkt %s)",
1150  PcapPacketCntGet(p), p->action, PktSrcToString(p->pkt_src));
1151  (void)DetectRunApplyPacketPolicy(de_ctx, det_ctx, scratch->fw_pkt_policy, p, true);
1152  DEBUG_VALIDATE_BUG_ON((p->action & (ACTION_DROP | ACTION_ACCEPT)) == 0);
1153  }
1154 }
1155 
1156 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
1157  Packet *p, Flow * const pflow)
1158 {
1159  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
1160  InspectionBufferClean(det_ctx);
1161 
1162  if (pflow != NULL) {
1163  /* update inspected tracker for raw reassembly */
1164  if (p->proto == IPPROTO_TCP && pflow->protoctx != NULL &&
1165  (p->flags & PKT_DETECT_HAS_STREAMDATA)) {
1166  StreamReassembleRawUpdateProgress(pflow->protoctx, p,
1167  det_ctx->raw_stream_progress);
1168  }
1169  }
1170  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP);
1171  SCReturn;
1172 }
1173 
1174 enum DetectTxFirewallFlowControl {
1175  DETECT_TX_FW_FC_OK = 0, /**< continue to next rule */
1176  DETECT_TX_FW_FC_SKIP = 1, /**< skip this rule, continue to next */
1177  DETECT_TX_FW_FC_BREAK = 2, /**< break rule loop */
1178 };
1179 
1180 void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
1181 {
1182  DEBUG_VALIDATE_BUG_ON(det_ctx->tx_candidates);
1183  det_ctx->tx_candidates = SCCalloc(size, sizeof(RuleMatchCandidateTx));
1184  if (det_ctx->tx_candidates == NULL) {
1185  FatalError("failed to allocate %" PRIu64 " bytes",
1186  (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
1187  }
1188  det_ctx->tx_candidates_size = size;
1189  SCLogDebug("array initialized to %u elements (%"PRIu64" bytes)",
1190  size, (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
1191 }
1192 
1193 void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
1194 {
1195  SCFree(det_ctx->tx_candidates);
1196  det_ctx->tx_candidates_size = 0;
1197 }
1198 
1199 /* if size >= cur_space */
1200 static inline bool RuleMatchCandidateTxArrayHasSpace(const DetectEngineThreadCtx *det_ctx,
1201  const uint32_t need)
1202 {
1203  if (det_ctx->tx_candidates_size >= need)
1204  return 1;
1205  return 0;
1206 }
1207 
1208 /* realloc */
1209 static int RuleMatchCandidateTxArrayExpand(DetectEngineThreadCtx *det_ctx, const uint32_t needed)
1210 {
1211  const uint32_t old_size = det_ctx->tx_candidates_size;
1212  uint32_t new_size = needed;
1213  void *ptmp = SCRealloc(det_ctx->tx_candidates, (new_size * sizeof(RuleMatchCandidateTx)));
1214  if (ptmp == NULL) {
1215  FatalError("failed to expand to %" PRIu64 " bytes",
1216  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx)));
1217  // TODO can this be handled more gracefully?
1218  }
1219  det_ctx->tx_candidates = ptmp;
1220  det_ctx->tx_candidates_size = new_size;
1221  SCLogDebug("array expanded from %u to %u elements (%"PRIu64" bytes -> %"PRIu64" bytes)",
1222  old_size, new_size, (uint64_t)(old_size * sizeof(RuleMatchCandidateTx)),
1223  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx))); (void)old_size;
1224  return 1;
1225 }
1226 
1227 /** \internal
1228  * \brief sort helper for sorting match candidates by id: ascending
1229  *
1230  * The id field is set from Signature::num, so we sort the candidates to match the signature
1231  * sort order (ascending), where candidates that have flags go first.
1232  */
1233 static int
1234 DetectRunTxSortHelper(const void *a, const void *b)
1235 {
1236  const RuleMatchCandidateTx *s0 = a;
1237  const RuleMatchCandidateTx *s1 = b;
1238  if (s1->id == s0->id) {
1239  if (s1->flags && !s0->flags)
1240  return 1;
1241  else if (!s1->flags && s0->flags)
1242  return -1;
1243  return 0;
1244  } else
1245  return s0->id > s1->id ? 1 : -1;
1246 }
1247 
1248 #if 0
1249 #define TRACE_SID_TXS(sid,txs,...) \
1250  do { \
1251  char _trace_buf[2048]; \
1252  snprintf(_trace_buf, sizeof(_trace_buf), __VA_ARGS__); \
1253  SCLogNotice("%p/%"PRIu64"/%u: %s", txs->tx_ptr, txs->tx_id, sid, _trace_buf); \
1254  } while(0)
1255 #else
1256 #define TRACE_SID_TXS(sid,txs,...)
1257 #endif
1258 
1259 /** \internal
1260  * \brief get correct transaction pointer
1261  *
1262  * Gets an encapsulated DNS transaction in the DOH2 case.
1263  *
1264  * Returns NULL is the TX is not to be inspected by this engine.
1265  */
1266 void *DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
1267 {
1268  SCLogDebug("pre: tx_ptr %p flow::alproto %s engine::alproto %s", tx_ptr,
1269  AppProtoToString(alproto), AppProtoToString(engine_alproto));
1270  if (unlikely(alproto == ALPROTO_DOH2)) {
1271  switch (engine_alproto) {
1272  case ALPROTO_DOH2:
1273  /* need to get the dns tx pointer */
1274  tx_ptr = SCDoH2GetDnsTx(tx_ptr, flow_flags);
1275  break;
1276  case ALPROTO_HTTP2:
1277  case ALPROTO_UNKNOWN:
1278  /* tx_ptr is untouched, so use outer (HTTP/2) layer */
1279  break;
1280  default:
1281  /* any other protocol is a mismatch with DOH2 */
1282  tx_ptr = NULL;
1283  break;
1284  }
1285  } else if (engine_alproto != alproto && engine_alproto != ALPROTO_UNKNOWN) {
1286  /* incompatible engine->alproto with flow alproto */
1287  tx_ptr = NULL;
1288  }
1289  return tx_ptr;
1290 }
1291 
1292 /** \internal
1293  * \brief inspect a rule against a transaction
1294  *
1295  * Inspect a rule. New detection or continued stateful
1296  * detection.
1297  *
1298  * \param stored_flags pointer to stored flags or NULL.
1299  * If stored_flags is set it means we're continuing
1300  * inspection from an earlier run.
1301  *
1302  * \retval 1 sig matched
1303  * \retval 0 partial incomplete match
1304  * \retval -1 failed to match
1305  */
1306 static int DetectRunTxInspectRule(ThreadVars *tv, DetectEngineCtx *de_ctx,
1307  DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f,
1308  const uint8_t in_flow_flags, // direction, EOF, etc
1309  void *alstate, DetectTransaction *tx, const Signature *s, uint32_t *stored_flags,
1310  RuleMatchCandidateTx *can, DetectRunScratchpad *scratch)
1311 {
1312  const uint8_t flow_flags = in_flow_flags;
1313  const int direction = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1314  uint32_t inspect_flags = stored_flags ? *stored_flags : 0;
1315  int total_matches = 0;
1316  uint16_t file_no_match = 0;
1317  bool mpm_before_progress = false; // is mpm engine before progress?
1318  bool mpm_in_progress = false; // is mpm engine in a buffer we will revisit?
1319 
1320  TRACE_SID_TXS(s->id, tx, "starting %s", direction ? "toclient" : "toserver");
1321 
1322  /* for a new inspection we inspect pkt header and packet matches */
1323  if (likely(stored_flags == NULL)) {
1324  TRACE_SID_TXS(s->id, tx, "first inspect, run packet matches");
1325  if (DetectRunInspectRuleHeader(p, f, s, s->flags) == false) {
1326  TRACE_SID_TXS(s->id, tx, "DetectRunInspectRuleHeader() no match");
1327  return -1;
1328  }
1329  if (!DetectEnginePktInspectionRun(tv, det_ctx, s, f, p, NULL)) {
1330  TRACE_SID_TXS(s->id, tx, "DetectEnginePktInspectionRun no match");
1331  return -1;
1332  }
1333  /* stream mpm and negated mpm sigs can end up here with wrong proto */
1334  if (!(AppProtoEquals(s->alproto, f->alproto) || s->alproto == ALPROTO_UNKNOWN)) {
1335  TRACE_SID_TXS(s->id, tx, "alproto mismatch");
1336  return -1;
1337  }
1338  } else {
1339  TRACE_SID_TXS(s->id, tx, "continue, inspect_flags %x", inspect_flags);
1340  }
1341 
1342  const DetectEngineAppInspectionEngine *engine = s->app_inspect;
1343  do {
1344  TRACE_SID_TXS(s->id, tx, "engine %p inspect_flags %x", engine, inspect_flags);
1345 
1346  // also if it is not the same direction, but
1347  // this is a transactional signature, and we are toclient
1348  if (!(inspect_flags & BIT_U32(engine->id)) &&
1349  (direction == engine->dir || ((s->flags & SIG_FLAG_TXBOTHDIR) && direction == 1))) {
1350 
1351  DEBUG_VALIDATE_BUG_ON(
1352  AppLayerParserSupportsSubStates(engine->alproto) && engine->sub_state == 0);
1353  DEBUG_VALIDATE_BUG_ON(
1354  !AppLayerParserSupportsSubStates(engine->alproto) && engine->sub_state != 0);
1355 
1356  if (engine->alproto != ALPROTO_UNKNOWN && // app-layer-events is registered for each
1357  // proto this way
1358  tx->tx_type != engine->sub_state) {
1359  TRACE_SID_TXS(s->id, tx,
1360  "skip because engine alproto %s sub_state %u != tx_type %u (engine "
1361  "progress %u)",
1362  AppProtoToString(engine->alproto), engine->sub_state, tx->tx_type,
1363  engine->progress);
1364  engine = engine->next;
1365  continue;
1366  }
1367  TRACE_SID_TXS(s->id, tx,
1368  "inspecting engine alproto %s sub_state %u == tx_type %u (engine progress %u)",
1369  AppProtoToString(engine->alproto), engine->sub_state, tx->tx_type,
1370  engine->progress);
1371 
1372  void *tx_ptr = DetectGetInnerTx(tx->tx_ptr, f->alproto, engine->alproto, flow_flags);
1373  if (tx_ptr == NULL) {
1374  TRACE_SID_TXS(s->id, tx, "no tx_ptr after DetectGetInnerTx");
1375  if (engine->alproto != ALPROTO_UNKNOWN) {
1376  TRACE_SID_TXS(s->id, tx, "no tx_ptr skip engine");
1377  /* special case: file_data on 'alert tcp' will have engines
1378  * in the list that are not for us. */
1379  engine = engine->next;
1380  continue;
1381  } else {
1382  tx_ptr = tx->tx_ptr;
1383  }
1384  }
1385  TRACE_SID_TXS(s->id, tx, "tx_ptr %p", tx_ptr);
1386 
1387  /* engines are sorted per progress, except that the one with
1388  * mpm/prefilter enabled is first */
1389  if (tx->tx_progress < engine->progress) {
1390  SCLogDebug("tx progress %d < engine progress %d",
1391  tx->tx_progress, engine->progress);
1392  break;
1393  }
1394  if (engine->mpm) {
1395  if (tx->tx_progress > engine->progress) {
1396  TRACE_SID_TXS(s->id, tx,
1397  "engine->mpm: t->tx_progress %u > engine->progress %u, so set "
1398  "mpm_before_progress",
1399  tx->tx_progress, engine->progress);
1400  mpm_before_progress = true;
1401  } else if (tx->tx_progress == engine->progress) {
1402  TRACE_SID_TXS(s->id, tx,
1403  "engine->mpm: t->tx_progress %u == engine->progress %u, so set "
1404  "mpm_in_progress",
1405  tx->tx_progress, engine->progress);
1406  if ((p->flags & PKT_PSEUDO_DETECTLOG_FLUSH) == 0) {
1407  mpm_in_progress = true;
1408  }
1409  }
1410  }
1411 
1412  uint8_t engine_flags = flow_flags;
1413  if (direction != engine->dir) {
1414  engine_flags = flow_flags ^ (STREAM_TOCLIENT | STREAM_TOSERVER);
1415  }
1416  /* run callback: but bypass stream callback if we can */
1417  uint8_t match;
1418  if (unlikely(engine->stream && can->stream_stored)) {
1419  match = can->stream_result;
1420  TRACE_SID_TXS(s->id, tx, "stream skipped, stored result %d used instead", match);
1421  } else if (engine->v2.Callback == NULL) {
1422  /* TODO is this the cleanest way to support a non-app sig on a app hook? */
1423 
1424  if (tx->tx_progress > engine->progress) {
1425  mpm_before_progress = true; // TODO needs a new name now
1426  }
1427 
1428  /* we don't have to store a "hook" match, also don't want to keep any state to make
1429  * sure the hook gets invoked again until tx progress progresses. */
1430  if ((s->flags & SIG_FLAG_FW_HOOK_LTE) == 0 && tx->tx_progress <= engine->progress) {
1431  return 1; // DETECT_ENGINE_INSPECT_SIG_MATCH;
1432  }
1433 
1434  /* if progress > engine progress, track state to avoid additional matches */
1435  match = DETECT_ENGINE_INSPECT_SIG_MATCH;
1436  } else {
1437  KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list);
1438  DEBUG_VALIDATE_BUG_ON(engine->v2.Callback == NULL);
1439  match = engine->v2.Callback(
1440  de_ctx, det_ctx, engine, s, f, engine_flags, alstate, tx_ptr, tx->tx_id);
1441  TRACE_SID_TXS(s->id, tx, "engine %p match %d", engine, match);
1442  if (engine->stream) {
1443  can->stream_stored = true;
1444  can->stream_result = match;
1445  TRACE_SID_TXS(s->id, tx, "stream ran, store result %d for next tx (if any)", match);
1446  }
1447  }
1448  if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) {
1449  inspect_flags |= BIT_U32(engine->id);
1450  engine = engine->next;
1451  total_matches++;
1452  continue;
1453  } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) {
1454  /* if the file engine matched, but indicated more
1455  * files are still in progress, we don't set inspect
1456  * flags as these would end inspection for this tx */
1457  engine = engine->next;
1458  total_matches++;
1459  continue;
1460  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) {
1461  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1462  inspect_flags |= BIT_U32(engine->id);
1463  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES) {
1464  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1465  inspect_flags |= BIT_U32(engine->id);
1466  file_no_match = 1;
1467  }
1468  /* implied DETECT_ENGINE_INSPECT_SIG_NO_MATCH */
1469  if (engine->mpm && mpm_before_progress) {
1470  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1471  inspect_flags |= BIT_U32(engine->id);
1472  }
1473  break;
1474  } else if (!(inspect_flags & BIT_U32(engine->id)) && s->flags & SIG_FLAG_TXBOTHDIR &&
1475  direction != engine->dir) {
1476  TRACE_SID_TXS(s->id, tx, "handle bidir engine");
1477 
1478  // for transactional rules, the engines on the opposite direction
1479  // are ordered by progress on the different side
1480  // so we have a two mixed-up lists, and we skip the elements
1481  if (direction == 0 && engine->next == NULL) {
1482  // do not match yet on request only
1483  break;
1484  }
1485  engine = engine->next;
1486  continue;
1487  }
1488 
1489  engine = engine->next;
1490  } while (engine != NULL);
1491  TRACE_SID_TXS(s->id, tx, "inspect_flags %x, total_matches %u, engine %p",
1492  inspect_flags, total_matches, engine);
1493 
1494  bool full_match = false;
1495  if (engine == NULL && total_matches) {
1496  inspect_flags |= DE_STATE_FLAG_FULL_INSPECT;
1497  TRACE_SID_TXS(s->id, tx, "MATCH");
1498  full_match = true;
1499  }
1500 
1501  if (stored_flags) {
1502  *stored_flags = inspect_flags;
1503  TRACE_SID_TXS(s->id, tx, "continue inspect flags %08x", inspect_flags);
1504  } else {
1505  // store... or? If tx is done we might not want to come back to this tx
1506 
1507  // also... if mpmid tracking is enabled, we won't do a sig again for this tx...
1508  TRACE_SID_TXS(s->id, tx, "start inspect flags %08x", inspect_flags);
1509  if (inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) {
1510  if (file_no_match) {
1511  /* if we have a mismatch on a file sig, we need to keep state.
1512  * We may get another file on the same tx (for http and smtp
1513  * at least), so for a new file we need to re-eval the sig.
1514  * Thoughts / TODO:
1515  * - not for some protos that have 1 file per tx (e.g. nfs)
1516  * - maybe we only need this for file sigs that mix with
1517  * other matches? E.g. 'POST + filename', is different than
1518  * just 'filename'.
1519  */
1520  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1521  inspect_flags, flow_flags, file_no_match);
1522  }
1523  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) && mpm_before_progress) {
1524  TRACE_SID_TXS(s->id, tx, "no need to store match sig, "
1525  "mpm won't trigger for it anymore");
1526 
1527  if (inspect_flags & DE_STATE_FLAG_FILE_INSPECT) {
1528  TRACE_SID_TXS(s->id, tx, "except that for new files, "
1529  "we may have to revisit anyway");
1530  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1531  inspect_flags, flow_flags, file_no_match);
1532  }
1533  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) == 0 && mpm_in_progress) {
1534  TRACE_SID_TXS(s->id, tx, "no need to store no-match sig, "
1535  "mpm will revisit it");
1536  return -1; /* no match */
1537  } else if (inspect_flags != 0 || file_no_match != 0) {
1538  TRACE_SID_TXS(s->id, tx, "storing state: flags %08x", inspect_flags);
1539  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1540  inspect_flags, flow_flags, file_no_match);
1541  } else {
1542  if (inspect_flags == 0) {
1543  TRACE_SID_TXS(s->id, tx, "no match: inspect_flags %08x", inspect_flags);
1544  return -1;
1545  }
1546  }
1547  }
1548  if (full_match) {
1549  return 1;
1550  /* can't be a partial match if we're at the end state */
1551  } else if ((inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) == 0 &&
1552  tx->tx_progress < tx->tx_end_state) {
1553  return 0;
1554  } else {
1555  return -1;
1556  }
1557 }
1558 
1559 #define NO_TX \
1560  { \
1561  NULL, 0, NULL, NULL, 0, 0, 0, 0, false, 0, \
1562  }
1563 
1564 /** \internal
1565  * \brief get a DetectTransaction object
1566  * \retval struct filled with relevant info or all nulls/0s
1567  */
1568 static DetectTransaction GetDetectTx(const uint8_t ipproto, const AppProto alproto,
1569  const uint64_t tx_id, void *tx_ptr, const int tx_end_state, const uint8_t flow_flags)
1570 {
1571  DEBUG_VALIDATE_BUG_ON(tx_end_state >= APP_LAYER_MAX_PROGRESS);
1572 
1573  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx_ptr);
1574  const uint8_t tx_progress =
1575  (uint8_t)AppLayerParserGetStateProgress(ipproto, alproto, tx_ptr, flow_flags);
1576  DEBUG_VALIDATE_BUG_ON(tx_progress >= APP_LAYER_MAX_PROGRESS);
1577 
1578  const uint8_t e_tx_end_state = txd->tx_type == 0 ? (uint8_t)tx_end_state
1579  : (flow_flags & STREAM_TOSERVER) ? txd->tx_type_eop_ts
1580  : txd->tx_type_eop_tc;
1581 
1582  bool updated = (flow_flags & STREAM_TOSERVER) ? txd->updated_ts : txd->updated_tc;
1583  if (!updated && tx_progress < e_tx_end_state && ((flow_flags & STREAM_EOF) == 0)) {
1584  DetectTransaction no_tx = NO_TX;
1585  return no_tx;
1586  }
1587  const uint8_t inspected_flag =
1588  (flow_flags & STREAM_TOSERVER) ? APP_LAYER_TX_INSPECTED_TS : APP_LAYER_TX_INSPECTED_TC;
1589  if (unlikely(txd->flags & inspected_flag)) {
1590  SCLogDebug("%" PRIu64 " tx already fully inspected for %s. Flags %02x", tx_id,
1591  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", txd->flags);
1592  DetectTransaction no_tx = NO_TX;
1593  return no_tx;
1594  }
1595  const uint8_t skip_flag = (flow_flags & STREAM_TOSERVER) ? APP_LAYER_TX_SKIP_INSPECT_TS
1596  : APP_LAYER_TX_SKIP_INSPECT_TC;
1597  if (unlikely(txd->flags & skip_flag)) {
1598  SCLogDebug("%" PRIu64 " tx should not be inspected in direction %s. Flags %02x", tx_id,
1599  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", txd->flags);
1600  DetectTransaction no_tx = NO_TX;
1601  return no_tx;
1602  }
1603 
1604  if (txd->tx_type != 0) {
1605  SCLogDebug("using tx_type %u", txd->tx_type);
1606  }
1607 
1608  const uint8_t detect_progress =
1609  (flow_flags & STREAM_TOSERVER) ? txd->detect_progress_ts : txd->detect_progress_tc;
1610 
1611  const int dir_int = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1612  DetectEngineState *tx_de_state = txd->de_state;
1613  DetectEngineStateDirection *tx_dir_state =
1614  tx_de_state ? &tx_de_state->dir_state[dir_int] : NULL;
1615  DetectTransaction tx = {
1616  .tx_ptr = tx_ptr,
1617  .tx_id = tx_id,
1618  .tx_data_ptr = (struct AppLayerTxData *)txd,
1619  .de_state = tx_dir_state,
1620  .detect_progress = detect_progress,
1621  .detect_progress_orig = detect_progress,
1622  .tx_progress = (uint8_t)tx_progress,
1623  .tx_end_state = e_tx_end_state,
1624  .is_last = false,
1625  .tx_type = txd->tx_type,
1626  };
1627  return tx;
1628 }
1629 
1630 static inline void StoreDetectProgress(
1631  DetectTransaction *tx, const uint8_t flow_flags, const uint8_t progress)
1632 {
1633  AppLayerTxData *txd = (AppLayerTxData *)tx->tx_data_ptr;
1634  if (flow_flags & STREAM_TOSERVER) {
1635  txd->detect_progress_ts = progress;
1636  } else {
1637  txd->detect_progress_tc = progress;
1638  }
1639 }
1640 
1641 // Merge 'state' rules from the regular prefilter
1642 // updates array_idx on the way
1643 static inline void RuleMatchCandidateMergeStateRules(
1644  DetectEngineThreadCtx *det_ctx, uint32_t *array_idx)
1645 {
1646  // Now, we will merge 2 sorted lists :
1647  // the one in det_ctx->tx_candidates
1648  // and the one in det_ctx->match_array
1649  // For match_array, we take only the relevant elements where s->app_inspect != NULL
1650 
1651  // Basically, we iterate at the same time over the 2 lists
1652  // comparing and taking an element from either.
1653 
1654  // Trick is to do so in place in det_ctx->tx_candidates,
1655  // so as to minimize the number of moves in det_ctx->tx_candidates.
1656  // For this, the algorithm traverses the lists in reverse order.
1657  // Otherwise, if the first element of match_array was to be put before
1658  // all tx_candidates, we would need to shift all tx_candidates
1659 
1660  // Retain the number of elements sorted in tx_candidates before merge
1661  uint32_t j = *array_idx;
1662  // First loop only counting the number of elements to add
1663  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
1664  const Signature *s = det_ctx->match_array[i];
1665  if (s->app_inspect != NULL) {
1666  (*array_idx)++;
1667  }
1668  }
1669  // Future number of elements in tx_candidates after merge
1670  uint32_t k = *array_idx;
1671 
1672  if (k == j) {
1673  // no new element from match_array to merge in tx_candidates
1674  return;
1675  }
1676 
1677  // variable i is for all elements of match_array (even not relevant ones)
1678  // variable j is for elements of tx_candidates before merge
1679  // variable k is for elements of tx_candidates after merge
1680  for (uint32_t i = det_ctx->match_array_cnt; i > 0;) {
1681  const Signature *s = det_ctx->match_array[i - 1];
1682  if (s->app_inspect == NULL) {
1683  // no relevant element, get the next one from match_array
1684  i--;
1685  continue;
1686  }
1687  // we have one element from match_array to merge in tx_candidates
1688  k--;
1689  if (j > 0) {
1690  // j > 0 means there is still at least one element in tx_candidates to merge
1691  const RuleMatchCandidateTx *s0 = &det_ctx->tx_candidates[j - 1];
1692  if (s->iid <= s0->id) {
1693  // get next element from previous tx_candidates
1694  j--;
1695  // take the element from tx_candidates before merge
1696  det_ctx->tx_candidates[k].s = det_ctx->tx_candidates[j].s;
1697  det_ctx->tx_candidates[k].id = det_ctx->tx_candidates[j].id;
1698  det_ctx->tx_candidates[k].flags = det_ctx->tx_candidates[j].flags;
1699  det_ctx->tx_candidates[k].stream_reset = det_ctx->tx_candidates[j].stream_reset;
1700  continue;
1701  }
1702  } // otherwise
1703  // get next element from match_array
1704  i--;
1705  // take the element from match_array
1706  det_ctx->tx_candidates[k].s = s;
1707  det_ctx->tx_candidates[k].id = s->iid;
1708  det_ctx->tx_candidates[k].flags = NULL;
1709  det_ctx->tx_candidates[k].stream_reset = 0;
1710  }
1711  // Even if k > 0 or j > 0, the loop is over. (Note that j == k now)
1712  // The remaining elements in tx_candidates up to k were already sorted
1713  // and come before any other element later in the list
1714 }
1715 
1716 struct DetectFirewallAppTxState {
1717  bool fw_skip_app_filter;
1718  bool skip_fw_hook;
1719  uint8_t skip_before_progress;
1720  bool fw_last_for_progress;
1721  bool fw_next_progress_missing;
1722  bool last_fw_rule; /**< processing the last fw rule, so we need to eval all hooks after it. */
1723 };
1724 
1725 static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p,
1726  const bool apply_to_packet, const DetectTransaction *tx,
1727  const struct DetectFirewallAppPolicy *ap)
1728 {
1729  if (EngineModeIsFirewall()) {
1730  const Signature *s = ap->alert_signature;
1731  BUG_ON(s == NULL);
1732  uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
1733  AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx->tx_id, tx->tx_type, alert_flags);
1734  }
1735 }
1736 
1737 /** \internal
1738  * \brief apply default policy
1739  * \param p packet to apply policy to
1740  * \param alproto app proto
1741  * \param progress hook / progress value to apply the policy to
1742  *
1743  * \note alproto and progress are unused right now, will be used
1744  * to look up configurable default policies later
1745  */
1746 static struct DetectFirewallPolicy DetectFirewallApplyDefaultAppPolicy(
1747  DetectEngineThreadCtx *det_ctx, const struct DetectFirewallPolicies *policies,
1748  const DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
1749  const uint8_t progress)
1750 {
1751  const uint8_t dir_flags = direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
1752 
1753  SCLogDebug("packet %" PRIu64 ": tx type %u", PcapPacketCntGet(p), tx->tx_type);
1754 
1755  const struct DetectFirewallPolicy drop_policy = { .action = ACTION_DROP,
1756  .action_scope = ACTION_SCOPE_FLOW };
1757  const struct DetectFirewallAppPolicy lookup = {
1758  .alproto = alproto, .sub_state = tx->tx_type, .progress = progress, .direction = dir_flags
1759  };
1760  const struct DetectFirewallPolicy *policy = NULL;
1761  const struct DetectFirewallAppPolicy *ap =
1762  HashTableLookup(policies->app_policies, (void *)&lookup, 0);
1763  /* table should be fully populated, so this should not be able to fail.
1764  * However as it continues to confuse tooling, at a fallback. */
1765  DEBUG_VALIDATE_BUG_ON(ap == NULL);
1766  if (likely(ap != NULL)) {
1767  policy = &ap->policy;
1768  } else {
1769  policy = &drop_policy;
1770  }
1771  if (policy->action & ACTION_DROP) {
1772  SCLogDebug("dropping packet PKT_DROP_REASON_FW_DEFAULT_APP_POLICY");
1773  PacketDrop(p, policy->action, PKT_DROP_REASON_FW_DEFAULT_APP_POLICY);
1774  if (policy->action_scope == ACTION_SCOPE_FLOW) {
1775  SCLogDebug("dropping flow");
1776  p->flow->flags |= FLOW_ACTION_DROP;
1777  p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
1778  }
1779  if (policy->action & ACTION_ALERT) {
1780  DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx, ap);
1781  }
1782  } else if (policy->action & ACTION_ACCEPT) {
1783  /* should the accept be applied to the packet?
1784  * ACTION_SCOPE_FLOW: yes
1785  * ACTION_SCOPE_TX: only if last_tx
1786  * ACTION_SCOPE_HOOK: only if last_tx and hook is highest available hook
1787  */
1788  const bool last_hook = progress == tx->tx_progress;
1789  bool apply_to_packet = false;
1790 
1791  switch (policy->action_scope) {
1792  case ACTION_SCOPE_FLOW:
1793  p->flow->flags |= FLOW_ACTION_ACCEPT;
1794  apply_to_packet = true;
1795  break;
1796  case ACTION_SCOPE_TX:
1797  tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT;
1798  apply_to_packet = tx->is_last;
1799  break;
1800  case ACTION_SCOPE_HOOK:
1801  apply_to_packet = tx->is_last && last_hook;
1802  break;
1803  default:
1804  /* should be unreachable */
1805  DEBUG_VALIDATE_BUG_ON(1);
1806  break;
1807  }
1808  SCLogDebug("packet %" PRIu64 " hook %u default policy ACCEPT, apply_to_packet:%s",
1809  PcapPacketCntGet(p), progress, BOOL2STR(apply_to_packet));
1810 
1811  if (policy->action & ACTION_ALERT) {
1812  SCLogDebug("policy alert, do the append");
1813  DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx, ap);
1814  } else if (apply_to_packet) {
1815  SCLogDebug("default accept: last_tx");
1816  DetectRunAppendDefaultAccept(det_ctx, p);
1817  }
1818  } else {
1819  /* should be unreachable */
1820  DEBUG_VALIDATE_BUG_ON(1);
1821  }
1822  return *policy;
1823 }
1824 
1825 /** \internal
1826  * \brief run default policies for hook(s)
1827  *
1828  * For a range of hooks look up the policy and apply it.
1829  *
1830  * \param is_last is this tx the last we have? Used to check if an action needs to be applied to
1831  * the packet.
1832  *
1833  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't be inspected
1834  * \retval DETECT_TX_FW_FC_SKIP skip current firewall rule
1835  * \retval DETECT_TX_FW_FC_OK no action needed
1836  */
1837 static enum DetectTxFirewallFlowControl DetectFirewallApplyDefaultPolicies(
1838  DetectEngineThreadCtx *det_ctx, const struct DetectFirewallPolicies *policies,
1839  DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
1840  const uint8_t start_hook, const uint8_t end_hook)
1841 {
1842  DEBUG_VALIDATE_BUG_ON(start_hook > end_hook);
1843 
1844  const bool need_verdict =
1845  tx->is_last && (end_hook == tx->tx_end_state || end_hook == tx->tx_progress);
1846  SCLogDebug("need_verdict:%s is_last:%s end_hook:%u tx->tx_end_state:%u tx->progress: %u",
1847  BOOL2STR(need_verdict), BOOL2STR(tx->is_last), end_hook, tx->tx_end_state,
1848  tx->tx_progress);
1849 
1850  for (uint8_t hook = start_hook; hook <= end_hook; hook++) {
1851  const bool apply_to_packet =
1852  tx->is_last && (hook == tx->tx_end_state || hook == tx->tx_progress);
1853 
1854  SCLogDebug("%" PRIu64 ": %s default policy for hook %u, apply_to_packet %s",
1855  PcapPacketCntGet(p), direction & STREAM_TOSERVER ? "toserver" : "toclient", hook,
1856  BOOL2STR(apply_to_packet));
1857 
1858  const struct DetectFirewallPolicy policy = DetectFirewallApplyDefaultAppPolicy(
1859  det_ctx, policies, tx, p, alproto, direction, hook);
1860  SCLogDebug("fw: hook:%u policy:%02x apply_to_packet:%s", hook, policy.action,
1861  BOOL2STR(apply_to_packet));
1862  if (policy.action & ACTION_DROP) {
1863  SCLogDebug("fw: action %02x", policy.action);
1864  return DETECT_TX_FW_FC_BREAK;
1865 
1866  } else if (policy.action & ACTION_ACCEPT) {
1867  SCLogDebug("fw: accept hook %u action %02x", hook, policy.action);
1868 
1869  /* accepting flow, so skip rest of the fw rules */
1870  if (policy.action_scope == ACTION_SCOPE_FLOW) {
1871  SCLogDebug("fw: accept flow");
1872  return DETECT_TX_FW_FC_SKIP;
1873 
1874  /* accepting flow, so skip rest of the fw rules for this tx */
1875  } else if (policy.action_scope == ACTION_SCOPE_TX) {
1876  return DETECT_TX_FW_FC_SKIP;
1877 
1878  } else if (policy.action_scope == ACTION_SCOPE_HOOK) {
1879  /* we're done */
1880  if (apply_to_packet) {
1881  return DETECT_TX_FW_FC_SKIP;
1882  }
1883  } else {
1884  DEBUG_VALIDATE_BUG_ON(1);
1885  }
1886  } else {
1887  DEBUG_VALIDATE_BUG_ON(1);
1888  }
1889  }
1890 
1891  /* if the tx progress is at end_hook state, it means the rule that called us cannot
1892  * match: it's app_progress_hook is not yet available. In this can we need to set
1893  * a default accept. This happens if we got only `accept:hook` policies. */
1894  if (need_verdict) {
1895  SCLogDebug("default accept: last tx and progress at end_hook %u", end_hook);
1896  DetectRunAppendDefaultAccept(det_ctx, p);
1897  /* break as we can't match the calling signature */
1898  return DETECT_TX_FW_FC_BREAK;
1899  }
1900 
1901  return DETECT_TX_FW_FC_OK;
1902 }
1903 
1904 /** \internal
1905  * \brief run pre-rule inspection firewall policy checks
1906  *
1907  * Check for:
1908  * - check if we're in accept:tx mode
1909  * - check for missing accept hooks
1910  * -
1911  *
1912  * \retval DETECT_TX_FW_FC_OK no action needed
1913  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't be inspected
1914  * \retval DETECT_TX_FW_FC_SKIP skip this rule
1915  */
1916 static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy(
1917  DetectEngineThreadCtx *det_ctx, Packet *p, DetectTransaction *tx, const uint8_t direction,
1918  const Signature *s, const uint32_t can_idx, struct DetectFirewallAppTxState *fw_state)
1919 {
1920  SCLogDebug("packet %" PRIu64 ": running pre-checks before sid %u", PcapPacketCntGet(p), s->id);
1921 
1922  /* enforce skip app filter. If a prior rule caused a fw_skip_app_filter set, we will skip
1923  * each fw rule from now. Non-FW rules will just be inspected. Non-FW need to hit this
1924  * path to help put into effect the FLOW_ACTION_ACCEPT/APP_LAYER_TX_ACCEPT and call
1925  * the default policy enforcement. */
1926  if (fw_state->fw_skip_app_filter) {
1927  if ((s->flags & SIG_FLAG_FIREWALL) != 0) {
1928  return DETECT_TX_FW_FC_SKIP;
1929  } else {
1930  return DETECT_TX_FW_FC_OK;
1931  }
1932  }
1933  if (p->flow->flags & FLOW_ACTION_ACCEPT) {
1934  fw_state->fw_skip_app_filter = true;
1935  SCLogDebug("default accept due to flow accept");
1936  DetectRunAppendDefaultAccept(det_ctx, p);
1937 
1938  if (s->flags & SIG_FLAG_FIREWALL) {
1939  return DETECT_TX_FW_FC_SKIP;
1940  }
1941  }
1942  /* skip fw rules if we're in accept:tx mode */
1943  if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) {
1944  /* append a blank accept:packet action for the APP_LAYER_TX_ACCEPT,
1945  * if this is the last tx */
1946  fw_state->fw_skip_app_filter = true;
1947  const bool accept_tx_applies_to_packet = tx->is_last;
1948  if (accept_tx_applies_to_packet) {
1949  SCLogDebug("accept:tx: should be applied to the packet");
1950  DetectRunAppendDefaultAccept(det_ctx, p);
1951  }
1952 
1953  if (s->flags & SIG_FLAG_FIREWALL) {
1954  SCLogDebug("APP_LAYER_TX_ACCEPT, so skip rule");
1955  return DETECT_TX_FW_FC_SKIP;
1956  }
1957 
1958  /* threat detect rules will be inspected */
1959  return DETECT_TX_FW_FC_OK;
1960  }
1961 
1962  /* handle missing rules case */
1963  if (s->flags & SIG_FLAG_FW_HOOK_LTE) {
1964  SCLogDebug("SIG_FLAG_FW_HOOK_LTE");
1965  return DETECT_TX_FW_FC_OK; // TODO check for other cases
1966  }
1967  /* if our first rule is beyond the starting state, we need to check if
1968  * there are rules missing for states in between. */
1969  if (s->app_progress_hook > tx->detect_progress_orig && can_idx == 0) {
1970  SCLogDebug("missing fw rules at list start: sid %u, progress %u (%u:%u)", s->id,
1971  s->app_progress_hook, tx->detect_progress, tx->detect_progress_orig);
1972  /* if this rule was after the state we expected meaning that there are
1973  * no rules for that state. Invoke the default policies. */
1974  enum DetectTxFirewallFlowControl r =
1975  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
1976  s->alproto, direction, tx->detect_progress_orig, s->app_progress_hook - 1);
1977  if (r != DETECT_TX_FW_FC_OK) {
1978  /* both SKIP and BREAK mean: no more fw rules to inspect.
1979  * SKIP applies to just this TX.
1980  * DROP applies to everything. */
1981  fw_state->fw_skip_app_filter = true;
1982  }
1983  return r;
1984  }
1985  return DETECT_TX_FW_FC_OK;
1986 }
1987 
1988 /**
1989  * \internal
1990  * \brief Check and update firewall rules state.
1991  *
1992  * \param fw_state pointer to flow control state
1993  *
1994  * \retval DETECT_TX_FW_FC_OK no action needed
1995  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't inspected
1996  * \retval DETECT_TX_FW_FC_SKIP skip this rule
1997  */
1998 static enum DetectTxFirewallFlowControl DetectRunTxCheckRuleState(DetectEngineThreadCtx *det_ctx,
1999  Packet *p, Flow *f, DetectTransaction *tx, const Signature *s, const uint32_t can_idx,
2000  const uint32_t can_size, struct DetectFirewallAppTxState *fw_state)
2001 {
2002  if (s->flags & SIG_FLAG_FIREWALL) {
2003  /* check if the next sig is on the same progress hook. If not, we need to apply our
2004  * default policy in case the current sig doesn't apply one. If the next sig has a
2005  * progress beyond our progress + 1, it means the next progress has no rules and needs
2006  * the default policy applied. But only after we evaluate the current rule first, as
2007  * that may override it. */
2008 
2009  if (can_idx + 1 < can_size) {
2010  const Signature *next_s = det_ctx->tx_candidates[can_idx + 1].s;
2011  SCLogDebug(
2012  "peek: peeking at sid %u / progress %u", next_s->id, next_s->app_progress_hook);
2013  if (next_s->flags & SIG_FLAG_FIREWALL) {
2014  if (s->app_progress_hook != next_s->app_progress_hook) {
2015  SCLogDebug("peek: next sid progress %u != current progress %u, so current "
2016  "is last for progress",
2017  next_s->app_progress_hook, s->app_progress_hook);
2018  fw_state->fw_last_for_progress = true;
2019 
2020  if (next_s->app_progress_hook - s->app_progress_hook > 1) {
2021  SCLogDebug("peek: missing progress, so we'll drop that unless we get a "
2022  "sweeping accept first");
2023  fw_state->fw_next_progress_missing = true;
2024  }
2025  }
2026  } else {
2027  SCLogDebug("peek: next sid not a fw rule, so current is last for progress");
2028  fw_state->fw_last_for_progress = true;
2029  fw_state->last_fw_rule = true;
2030  }
2031  } else {
2032  SCLogDebug("peek: no peek beyond last rule");
2033  if (s->app_progress_hook < tx->tx_progress) {
2034  SCLogDebug("peek: there are no rules to allow the state after this rule");
2035  fw_state->fw_next_progress_missing = true;
2036  }
2037  fw_state->fw_last_for_progress = true;
2038  fw_state->last_fw_rule = true;
2039  }
2040 
2041  if (fw_state->skip_fw_hook == true) {
2042  if (s->app_progress_hook <= fw_state->skip_before_progress) {
2043  return DETECT_TX_FW_FC_SKIP;
2044  }
2045  fw_state->skip_fw_hook = false;
2046  }
2047  } else {
2048  /* fw mode, we skip anything after the fw rules if:
2049  * - flow pass is set
2050  * - packet pass (e.g. exception policy) */
2051  if (p->flags & PKT_NOPACKET_INSPECTION || (f->flags & (FLOW_ACTION_PASS))) {
2052  SCLogDebug("skipping firewall rule %u", s->id);
2053  return DETECT_TX_FW_FC_BREAK;
2054  }
2055  }
2056  return DETECT_TX_FW_FC_OK;
2057 }
2058 
2059 // TODO move into det_ctx?
2060 thread_local Signature default_accept;
2061 static void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet *p)
2062 {
2063  DEBUG_VALIDATE_BUG_ON(!EngineModeIsFirewall());
2064  SCLogDebug("packet %" PRIu64 ": appending default firewall accept", PcapPacketCntGet(p));
2065  memset(&default_accept, 0, sizeof(default_accept));
2066  default_accept.action = ACTION_ACCEPT;
2067  default_accept.action_scope = ACTION_SCOPE_PACKET;
2068  default_accept.iid = UINT32_MAX;
2069  default_accept.type = SIG_TYPE_PKT;
2070  default_accept.flags = SIG_FLAG_FIREWALL;
2071  default_accept.detect_table =
2072  DETECT_TABLE_APP_FILTER; // TODO review, hope this makes it last in sorting
2073  AlertQueueAppendPacket(det_ctx, &default_accept, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
2074 }
2075 
2076 /** \internal
2077  * \brief see if the accept rule needs to apply to the packet
2078  */
2079 static inline bool ApplyAcceptToPacket(const DetectTransaction *tx, const Signature *s)
2080 {
2081  if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
2082  return false;
2083  }
2084  if ((s->action & ACTION_ACCEPT) == 0) {
2085  return false;
2086  }
2087 
2088  /* for accept:tx we need:
2089  * - packet will only be accepted if this is set on the last tx
2090  */
2091  if (s->action_scope == ACTION_SCOPE_TX) {
2092  if (tx->is_last) {
2093  return true;
2094  }
2095  }
2096  /* for accept:hook we need a bit more checking:
2097  * - packet will only be accepted if this is set on the last tx
2098  * - the hook accepted should be the last progress available. */
2099  if (s->action_scope == ACTION_SCOPE_HOOK) {
2100  if (tx->is_last && (s->app_progress_hook == tx->tx_progress)) {
2101  return true;
2102  }
2103  }
2104  return false;
2105 }
2106 
2107 /** \internal
2108  * \brief apply an accept, but do check policies when needed
2109  *
2110  * Updates flow control where needed.
2111  *
2112  * */
2113 static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packet *p,
2114  const uint8_t direction, const Signature *s, DetectTransaction *tx,
2115  struct DetectFirewallAppTxState *fw_state)
2116 {
2117  const enum ActionScope as = s->action_scope;
2118  /* accept:hook: jump to first rule of next state.
2119  * Implemented as skip until the first rule of next state. */
2120  if (as == ACTION_SCOPE_HOOK) {
2121  fw_state->skip_fw_hook = true;
2122  fw_state->skip_before_progress = s->app_progress_hook;
2123 
2124  SCLogDebug("fw match sid:%u hook:%u", s->id, s->app_progress_hook);
2125  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2126  "skip_before_progress:%u fw_last_for_progress:%s fw_next_progress_missing:%s",
2127  BOOL2STR(fw_state->fw_skip_app_filter), BOOL2STR(fw_state->skip_fw_hook),
2128  fw_state->skip_before_progress, BOOL2STR(fw_state->fw_last_for_progress),
2129  BOOL2STR(fw_state->fw_next_progress_missing));
2130  /* if there is no fw rule for the next progress value,
2131  * we invoke the defaul policies for the remaining available hooks. */
2132  if (fw_state->fw_next_progress_missing) {
2133  const uint8_t last_hook = fw_state->last_fw_rule
2134  ? tx->tx_end_state
2135  : MIN(tx->tx_end_state, s->app_progress_hook + 1);
2136  enum DetectTxFirewallFlowControl r =
2137  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
2138  s->alproto, direction, s->app_progress_hook + 1, last_hook);
2139  if (r == DETECT_TX_FW_FC_BREAK) {
2140  fw_state->fw_skip_app_filter = true;
2141  return;
2142  }
2143  }
2144  } else if (as == ACTION_SCOPE_TX) {
2145  tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT;
2146  fw_state->skip_fw_hook = true;
2147  fw_state->skip_before_progress = tx->tx_end_state + 1; // skip all hooks
2148  SCLogDebug("accept:tx applied, skip_fw_hook, skip_before_progress %u",
2149  fw_state->skip_before_progress);
2150  } else if (as == ACTION_SCOPE_PACKET) {
2151  fw_state->fw_skip_app_filter = true;
2152  } else if (as == ACTION_SCOPE_FLOW) {
2153  SCLogDebug("sid %u: ACTION_ACCEPT with ACTION_SCOPE_FLOW", s->id);
2154  fw_state->fw_skip_app_filter = true;
2155  }
2156 }
2157 
2158 /**
2159  * \internal
2160  * \brief check if there are no (fw) rules, and apply the default policies if so
2161  *
2162  * \retval 3 policies handled, continue with inspection
2163  * \retval 2 continue with next tx
2164  * \retval 1 done with inspection
2165  * \retval 0 ok, continue as normal. No policies applied.
2166  */
2167 static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f,
2168  DetectTransaction *tx, const AppProto alproto, const uint8_t flow_flags, const int rule_cnt)
2169 {
2170  /* if there are no rules / rule candidates, handling invoking the default
2171  * policy. */
2172  if (rule_cnt == 0 || (det_ctx->tx_candidates[0].s->flags & SIG_FLAG_FIREWALL) == 0) {
2173  /* if there are no rules, make sure to handle accept:flow and accept:tx */
2174  if (rule_cnt == 0) {
2175  if (f->flags & FLOW_ACTION_ACCEPT) {
2176  SCLogDebug("default accept:flow: no rules");
2177  DetectRunAppendDefaultAccept(det_ctx, p);
2178  return 1;
2179  }
2180  if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) {
2181  /* current tx is the last we have, append a blank accept:packet */
2182  if (tx->is_last) {
2183  SCLogDebug("default accept:tx: no rules");
2184  DetectRunAppendDefaultAccept(det_ctx, p);
2185  return 1;
2186  }
2187  return 2;
2188  }
2189  }
2190 
2191  /* if there are no fw rules, handle default policies */
2192  if ((f->flags & FLOW_ACTION_ACCEPT) == 0 &&
2193  (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) == 0) {
2194  /* No rules to eval, so we need to see if there are default policies to apply.
2195  * Start at last inspected progress and check each hook. If all hooks accepted,
2196  * apply the accept to the packet. */
2197  SCLogDebug("tx.detect_progress_orig %u tx.tx_progress %u", tx->detect_progress_orig,
2198  tx->tx_progress);
2199  enum DetectTxFirewallFlowControl r =
2200  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
2201  alproto, flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT),
2202  tx->detect_progress_orig, tx->tx_progress);
2203  SCLogDebug("r %u", r);
2204  if (r == DETECT_TX_FW_FC_BREAK)
2205  return 1;
2206  if (r == DETECT_TX_FW_FC_SKIP)
2207  return 2;
2208  /* continue with TD rules */
2209  SCLogDebug("continue with TD rules");
2210  return 3;
2211  }
2212  }
2213  return 0;
2214 }
2215 
2216 /** \internal
2217  * \brief handle a full rule match for a firewall rule
2218  *
2219  * For a drop/reject rule, excute action immediately.
2220  * For an accept rule, add an alert even to the queue. This will
2221  * allow TD rules to override the accept.
2222  */
2223 static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
2224  DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p,
2225  const uint8_t flow_flags)
2226 {
2227  if (s->action & ACTION_ACCEPT) {
2228  /* add alert now, as ApplyAccept may also trigger
2229  * policy matches that could add alerts. */
2230  SCLogDebug("append alert");
2231  /* see if we need to apply tx/hook accept to the packet. This can be needed
2232  * when we've completed the inspection so far for an incomplete tx, and an
2233  * accept:tx or accept:hook is the last match.*/
2234  const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
2235  if (fw_accept_to_packet) {
2236  SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
2237  SCLogDebug("accept:(tx|hook): should be applied to the packet");
2238  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type,
2239  PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
2240  } else {
2241  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2242  }
2243  DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
2244  } else if (s->action & ACTION_DROP) {
2245  SCLogDebug("drop packet because of rule with drop action");
2246  PacketDrop(p, s->action, PKT_DROP_REASON_FW_RULES);
2247  if (s->action_scope == ACTION_SCOPE_FLOW) {
2248  SCLogDebug("drop flow because of rule with drop action");
2249  f->flags |= FLOW_ACTION_DROP;
2250  f->flags |= FLOW_ACTION_BY_FIREWALL;
2251  }
2252  SCLogDebug("append alert");
2253  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2254  } else {
2255  SCLogDebug("append alert");
2256  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2257  }
2258 }
2259 
2260 /** \internal
2261  * \brief handle a partial match for firewall rules
2262  *
2263  * Currently only used for LTE mode. Regardless of the final action,
2264  * the partial match acts as a `accept:hook`.
2265  *
2266  * A default accept is appended. TD has a chance to override this accept.
2267  *
2268  * \retval 1 accept partial, caller must break loop
2269  * \retval 0 ok, caller must continue as normal
2270  */
2271 static int DetectRunTxFirewallRulePartialMatch(
2272  DetectEngineThreadCtx *det_ctx, const Signature *s, const DetectTransaction *tx, Packet *p)
2273 {
2274  if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT)) {
2275  /* partial match always uses ACTION_SCOPE_HOOK. Final action only on the full
2276  * match */
2277  if (tx->is_last) {
2278  SCLogDebug("need to apply accept to packet");
2279  DetectRunAppendDefaultAccept(det_ctx, p);
2280  }
2281  if (s->action_scope == ACTION_SCOPE_FLOW) {
2282  SCLogDebug("only applying accept:flow on full match, downgrading to "
2283  "accept:hook");
2284  }
2285  return 1;
2286  }
2287  return 0;
2288 }
2289 
2290 /** \internal
2291  * \brief handle the no-match case for a firewall rule
2292  *
2293  * If the rule did not match we need to see if we need invoke the default
2294  * policy for this hook. If that is the case, we handle a drop by telling the
2295  * caller about it. Flow control for various accept options is handled by the
2296  * next rule.
2297  *
2298  * \retval 1 dropped by policy, caller must return
2299  * \retval 0 ok, caller must continue as normal
2300  */
2301 static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
2302  DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Packet *p,
2303  const uint8_t flow_flags)
2304 {
2305  if (fw_state->fw_last_for_progress && (s->flags & SIG_FLAG_FIREWALL)) {
2306  SCLogDebug("%" PRIu64 ": %s default policy for progress %u", PcapPacketCntGet(p),
2307  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", s->app_progress_hook);
2308  /* if this rule was the last for our progress state, and it didn't match,
2309  * we have to invoke the default policy. We only check the current rule hook.
2310  * DROP is immediate, flow control for various accept options is handled by
2311  * the DetectRunTxPreCheckFirewallPolicy function for the next rule. */
2312  const struct DetectFirewallPolicy policy = DetectFirewallApplyDefaultAppPolicy(det_ctx,
2313  det_ctx->de_ctx->fw_policies, tx, p, s->alproto, flow_flags, s->app_progress_hook);
2314  SCLogDebug("fw_last_for_progress policy %02x", policy.action);
2315  if (policy.action & ACTION_DROP) {
2316  return 1;
2317  }
2318  }
2319  return 0;
2320 }
2321 
2322 /** \internal
2323  * \brief handle full match on rule when state didn't progress yet
2324  *
2325  * For a full rule match on a certain hook, we need to continue to enforce the
2326  * match as long as the tx progress doesn't move beyond that hook.
2327  */
2328 static void DetectRunTxFirewallRuleStatefulReApplyMatch(DetectEngineThreadCtx *det_ctx,
2329  const Signature *s, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state,
2330  Packet *p, const uint8_t flow_flags)
2331 {
2332  /* if we're still in the same progress state as an earlier full
2333  * match, we need to apply the same accept */
2334  if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT) &&
2335  s->app_progress_hook == tx->tx_progress) {
2336  const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
2337  DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
2338  if (fw_accept_to_packet) {
2339  SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
2340  DetectRunAppendDefaultAccept(det_ctx, p);
2341  }
2342  }
2343 }
2344 
2345 static void DetectRunTx(ThreadVars *tv,
2346  DetectEngineCtx *de_ctx,
2347  DetectEngineThreadCtx *det_ctx,
2348  Packet *p,
2349  Flow *f,
2350  DetectRunScratchpad *scratch)
2351 {
2352  const uint8_t flow_flags = scratch->flow_flags;
2353  const SigGroupHead * const sgh = scratch->sgh;
2354  void * const alstate = f->alstate;
2355  const uint8_t ipproto = f->proto;
2356  const AppProto alproto = f->alproto;
2357 
2358  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
2359  uint64_t tx_id_min = AppLayerParserGetTransactionInspectId(f->alparser, flow_flags);
2360  const int tx_end_state = AppLayerParserGetStateProgressCompletionStatus(alproto, flow_flags);
2361 
2362  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
2363  AppLayerGetTxIterState state = { 0 };
2364 
2365  uint32_t tx_inspected = 0;
2366  const bool have_fw_rules = EngineModeIsFirewall();
2367  /* if we skipped the last tx, we did not have a chance to apply a fw accept to the packet. Since
2368  * the tx is skipped, we should consider it accepted. */
2369  bool last_tx_skipped = false;
2370 
2371  SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
2372  SCLogDebug("total_txs %" PRIu64, total_txs);
2373 
2374  while (1) {
2375  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);
2376  if (ires.tx_ptr == NULL) {
2377  SCLogDebug("%p/%" PRIu64 " no transaction to inspect", ires.tx_ptr, tx_id_min);
2378  break;
2379  }
2380 
2381  DetectTransaction tx =
2382  GetDetectTx(ipproto, alproto, ires.tx_id, ires.tx_ptr, tx_end_state, flow_flags);
2383  if (tx.tx_ptr == NULL) {
2384  SCLogDebug("%p/%"PRIu64" no transaction to inspect",
2385  tx.tx_ptr, tx_id_min);
2386  last_tx_skipped = !ires.has_next;
2387  tx_id_min++; // next (if any) run look for +1
2388  goto next;
2389  }
2390  tx.is_last = !ires.has_next;
2391  tx_id_min = tx.tx_id + 1; // next look for cur + 1
2392  tx_inspected++;
2393 
2394  SCLogDebug("%p/%" PRIu64 " txd flags %02x", tx.tx_ptr, tx.tx_id, tx.tx_data_ptr->flags);
2395  SCLogDebug("%p/%" PRIu64 " is_last %s", tx.tx_ptr, tx.tx_id, BOOL2STR(tx.is_last));
2396 
2397  det_ctx->tx_id = tx.tx_id;
2398  det_ctx->tx_id_set = true;
2399  det_ctx->p = p;
2400 
2401  bool do_sort = false; // do we need to sort the tx candidate list?
2402  uint32_t array_idx = 0;
2403  uint32_t total_rules = det_ctx->match_array_cnt;
2404  total_rules += (tx.de_state ? tx.de_state->cnt : 0);
2405 
2406  /* run prefilter engines and merge results into a candidates array */
2407  if (sgh && sgh->tx_engines) {
2408  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX);
2409  DetectRunPrefilterTx(det_ctx, sgh, p, ipproto, flow_flags, alproto,
2410  alstate, &tx);
2411  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX);
2412  SCLogDebug("%p/%"PRIu64" rules added from prefilter: %u candidates",
2413  tx.tx_ptr, tx.tx_id, det_ctx->pmq.rule_id_array_cnt);
2414 
2415  total_rules += det_ctx->pmq.rule_id_array_cnt;
2416  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
2417  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2418  }
2419 
2420  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
2421  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
2422  const SigIntId id = s->iid;
2423  det_ctx->tx_candidates[array_idx].s = s;
2424  det_ctx->tx_candidates[array_idx].id = id;
2425  det_ctx->tx_candidates[array_idx].flags = NULL;
2426  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2427  array_idx++;
2428  }
2429  PMQ_RESET(&det_ctx->pmq);
2430  } else {
2431  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
2432  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2433  }
2434  }
2435 
2436  /* merge 'state' rules from the regular prefilter */
2437 #ifdef PROFILING
2438  uint32_t x = array_idx;
2439 #endif
2440  RuleMatchCandidateMergeStateRules(det_ctx, &array_idx);
2441 
2442  /* merge stored state into results */
2443  if (tx.de_state != NULL) {
2444  const uint32_t old = array_idx;
2445 
2446  /* if tx.de_state->flags has 'new file' set and sig below has
2447  * 'file inspected' flag, reset the file part of the state */
2448  const bool have_new_file = (tx.de_state->flags & DETECT_ENGINE_STATE_FLAG_FILE_NEW);
2449  if (have_new_file) {
2450  SCLogDebug("%p/%"PRIu64" destate: need to consider new file",
2451  tx.tx_ptr, tx.tx_id);
2452  tx.de_state->flags &= ~DETECT_ENGINE_STATE_FLAG_FILE_NEW;
2453  }
2454 
2455  SigIntId state_cnt = 0;
2456  DeStateStore *tx_store = tx.de_state->head;
2457  for (; tx_store != NULL; tx_store = tx_store->next) {
2458  SCLogDebug("tx_store %p", tx_store);
2459 
2460  SigIntId store_cnt = 0;
2461  for (store_cnt = 0;
2462  store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < tx.de_state->cnt;
2463  store_cnt++, state_cnt++)
2464  {
2465  DeStateStoreItem *item = &tx_store->store[store_cnt];
2466  SCLogDebug("rule id %u, inspect_flags %u", item->sid, item->flags);
2467  if (have_new_file && (item->flags & DE_STATE_FLAG_FILE_INSPECT)) {
2468  /* remove part of the state. File inspect engine will now
2469  * be able to run again */
2470  item->flags &= ~(DE_STATE_FLAG_SIG_CANT_MATCH|DE_STATE_FLAG_FULL_INSPECT|DE_STATE_FLAG_FILE_INSPECT);
2471  SCLogDebug("rule id %u, post file reset inspect_flags %u", item->sid, item->flags);
2472  }
2473  det_ctx->tx_candidates[array_idx].s = de_ctx->sig_array[item->sid];
2474  det_ctx->tx_candidates[array_idx].id = item->sid;
2475  det_ctx->tx_candidates[array_idx].flags = &item->flags;
2476  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2477  array_idx++;
2478  }
2479  }
2480  do_sort |= (old && old != array_idx); // sort if continue list adds sids
2481  SCLogDebug("%p/%" PRIu64 " rules added from 'continue' list: %u", tx.tx_ptr, tx.tx_id,
2482  array_idx - old);
2483  }
2484  if (do_sort) {
2485  qsort(det_ctx->tx_candidates, array_idx, sizeof(RuleMatchCandidateTx),
2486  DetectRunTxSortHelper);
2487  }
2488 
2489 #ifdef PROFILING
2490  if (array_idx >= de_ctx->profile_match_logging_threshold)
2491  RulesDumpTxMatchArray(det_ctx, scratch->sgh, p, tx.tx_id, array_idx, x);
2492 #endif
2493 
2494 #ifdef DEBUG
2495  for (uint32_t i = 0; i < array_idx; i++) {
2496  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
2497  const Signature *s = det_ctx->tx_candidates[i].s;
2498  SCLogDebug("%u: sid %u flags %p", i, s->id, can->flags);
2499  }
2500 #endif
2501 
2502  struct DetectFirewallAppTxState fw_state = {
2503  false,
2504  false,
2505  0,
2506  false,
2507  false,
2508  false,
2509  };
2510 
2511  SCLogDebug("%s: tx_progress %u tx %p have_fw_rules %s array_idx %u detect_progress_orig %u "
2512  "cur detect_progress %u",
2513  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
2514  tx.tx_data_ptr, BOOL2STR(have_fw_rules), array_idx, tx.detect_progress_orig,
2515  tx.detect_progress);
2516 
2517  if (have_fw_rules) {
2518  /* if there are no firewall rules to consider, handle invoking the default
2519  * policies. */
2520  const int r = DetectTxFirewallNoRulesApplyPolicies(
2521  det_ctx, p, f, &tx, alproto, flow_flags, array_idx);
2522  if (r == 1) {
2523  SCLogDebug("done");
2524  return;
2525  } else if (r == 2) {
2526  goto next_tx_fw; /* next tx, need to clean up buffers */
2527  }
2528  }
2529 
2530  /* run rules: inspect the match candidates */
2531  for (uint32_t i = 0; i < array_idx; i++) {
2532  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
2533  const Signature *s = det_ctx->tx_candidates[i].s;
2534  uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags;
2535 
2536  SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", PcapPacketCntGet(p), s->id,
2537  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
2538  tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook);
2539 
2540  if (have_fw_rules) {
2541  const enum DetectTxFirewallFlowControl fw_r =
2542  DetectRunTxPreCheckFirewallPolicy(det_ctx, p, &tx,
2543  flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT), s, i, &fw_state);
2544  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2545  "skip_before_progress:%u fw_last_for_progress:%s "
2546  "fw_next_progress_missing:%s",
2547  BOOL2STR(fw_state.fw_skip_app_filter), BOOL2STR(fw_state.skip_fw_hook),
2548  fw_state.skip_before_progress, BOOL2STR(fw_state.fw_last_for_progress),
2549  BOOL2STR(fw_state.fw_next_progress_missing));
2550  if (fw_r == DETECT_TX_FW_FC_SKIP) {
2551  continue;
2552  } else if (fw_r == DETECT_TX_FW_FC_BREAK) {
2553  break;
2554  }
2555 
2556  fw_state.fw_last_for_progress = false;
2557  fw_state.fw_next_progress_missing = false; // reset
2558  }
2559 
2560  /* deduplicate: rules_array is sorted, but not deduplicated:
2561  * both mpm and stored state could give us the same sid.
2562  * As they are back to back in that case we can check for it
2563  * here. We select the stored state one as that comes first
2564  * in the array. */
2565  while ((i + 1) < array_idx &&
2566  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
2567  SCLogDebug("%p/%" PRIu64 " inspecting SKIP NEXT: sid %u (%u), flags %08x",
2568  tx.tx_ptr, tx.tx_id, s->id, s->iid, inspect_flags ? *inspect_flags : 0);
2569  i++;
2570  }
2571 
2572  SCLogDebug("%p/%" PRIu64 " inspecting: sid %u (%u), flags %08x", tx.tx_ptr, tx.tx_id,
2573  s->id, s->iid, inspect_flags ? *inspect_flags : 0);
2574 
2575  if (inspect_flags) {
2576  if (*inspect_flags & DE_STATE_FLAG_FULL_INSPECT) {
2577  SCLogDebug("%p/%" PRIu64
2578  " inspecting: sid %u (%u), flags %08x DE_STATE_FLAG_FULL_INSPECT",
2579  tx.tx_ptr, tx.tx_id, s->id, s->iid, *inspect_flags);
2580 
2581  /* if we're still in the same progress state as an earlier full
2582  * match, we need to apply the same accept */
2583  if (have_fw_rules) {
2584  DetectRunTxFirewallRuleStatefulReApplyMatch(
2585  det_ctx, s, &tx, &fw_state, p, flow_flags);
2586  }
2587  continue;
2588  }
2589  if (*inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) {
2590  SCLogDebug("%p/%" PRIu64
2591  " inspecting: sid %u (%u), flags %08x DE_STATE_FLAG_SIG_CANT_MATCH",
2592  tx.tx_ptr, tx.tx_id, s->id, s->iid, *inspect_flags);
2593  continue;
2594  }
2595 
2596  /* continue previous inspection */
2597  SCLogDebug("%p/%" PRIu64 " Continuing sid %u", tx.tx_ptr, tx.tx_id, s->id);
2598  } else {
2599  /* start new inspection */
2600  SCLogDebug("%p/%"PRIu64" Start sid %u", tx.tx_ptr, tx.tx_id, s->id);
2601  }
2602 
2603  if (have_fw_rules) {
2604  /* check if we should run this rule and update the firewall flow state */
2605  const enum DetectTxFirewallFlowControl fw_r =
2606  DetectRunTxCheckRuleState(det_ctx, p, f, &tx, s, i, array_idx, &fw_state);
2607  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2608  "skip_before_progress:%u fw_last_for_progress:%s "
2609  "fw_next_progress_missing:%s",
2610  BOOL2STR(fw_state.fw_skip_app_filter), BOOL2STR(fw_state.skip_fw_hook),
2611  fw_state.skip_before_progress, BOOL2STR(fw_state.fw_last_for_progress),
2612  BOOL2STR(fw_state.fw_next_progress_missing));
2613  if (fw_r == DETECT_TX_FW_FC_SKIP)
2614  continue;
2615  else if (fw_r == DETECT_TX_FW_FC_BREAK)
2616  break;
2617  }
2618 
2619  /* call individual rule inspection */
2620  RULE_PROFILING_START(p);
2621  const int r = DetectRunTxInspectRule(tv, de_ctx, det_ctx, p, f, flow_flags,
2622  alstate, &tx, s, inspect_flags, can, scratch);
2623  SCLogDebug("s %u r %d", s->id, r);
2624  if (r == 1) {
2625  /* match */
2626  DetectRunPostMatch(tv, det_ctx, p, s);
2627 
2628  SCLogDebug(
2629  "%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid);
2630 
2631  if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
2632  AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, tx.tx_type, 0);
2633  } else {
2634  DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
2635  }
2636  } else if (r == 0) {
2637  SCLogDebug("sid %u partial match", s->id);
2638  if (DetectRunTxFirewallRulePartialMatch(det_ctx, s, &tx, p) == 1) {
2639  break;
2640  }
2641  } else {
2642  if (DetectRunTxFirewallRuleNoMatch(det_ctx, s, &tx, &fw_state, p, flow_flags) ==
2643  1) {
2644  return;
2645  }
2646  }
2647  DetectVarProcessList(det_ctx, p->flow, p);
2648  RULE_PROFILING_END(det_ctx, s, r, p);
2649 
2650  if (det_ctx->post_rule_work_queue.len > 0) {
2651  SCLogDebug("%p/%" PRIu64 " post_rule_work_queue len %u", tx.tx_ptr, tx.tx_id,
2652  det_ctx->post_rule_work_queue.len);
2653  /* run post match prefilter engines on work queue */
2654  PrefilterPostRuleMatch(det_ctx, scratch->sgh, p, f);
2655 
2656  uint32_t prev_array_idx = array_idx;
2657  for (uint32_t j = 0; j < det_ctx->pmq.rule_id_array_cnt; j++) {
2658  const Signature *ts = de_ctx->sig_array[det_ctx->pmq.rule_id_array[j]];
2659  if (ts->app_inspect != NULL) {
2660  const SigIntId id = ts->iid;
2661  det_ctx->tx_candidates[array_idx].s = ts;
2662  det_ctx->tx_candidates[array_idx].id = id;
2663  det_ctx->tx_candidates[array_idx].flags = NULL;
2664  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2665  array_idx++;
2666 
2667  SCLogDebug("%p/%" PRIu64 " rule %u (%u) added from 'post match' prefilter",
2668  tx.tx_ptr, tx.tx_id, ts->id, id);
2669  }
2670  }
2671  SCLogDebug("%p/%" PRIu64 " rules added from 'post match' prefilter: %u", tx.tx_ptr,
2672  tx.tx_id, array_idx - prev_array_idx);
2673  if (prev_array_idx != array_idx) {
2674  /* sort, but only part of array we're still going to process */
2675  qsort(det_ctx->tx_candidates + i, array_idx - i, sizeof(RuleMatchCandidateTx),
2676  DetectRunTxSortHelper);
2677  }
2678  det_ctx->post_rule_work_queue.len = 0;
2679  PMQ_RESET(&det_ctx->pmq);
2680  }
2681  }
2682 
2683  det_ctx->tx_id = 0;
2684  det_ctx->tx_id_set = false;
2685  det_ctx->p = NULL;
2686 
2687  /* see if we have any updated state to store in the tx */
2688 
2689  /* this side of the tx is done */
2690  if (tx.tx_progress >= tx.tx_end_state) {
2691  SCLogDebug("%" PRIu64 ": %s tx done", PcapPacketCntGet(p),
2692  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
2693  const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER)
2694  ? APP_LAYER_TX_INSPECTED_TS
2695  : APP_LAYER_TX_INSPECTED_TC;
2696  tx.tx_data_ptr->flags |= inspected_flag;
2697  SCLogDebug("%p/%" PRIu64 " tx is done for direction %s. Progress %02x", tx.tx_ptr,
2698  tx.tx_id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient",
2699  tx.detect_progress);
2700  }
2701 
2702  if (tx.detect_progress != tx.detect_progress_orig) {
2703  SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", PcapPacketCntGet(p),
2704  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig,
2705  tx.detect_progress);
2706  SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id,
2707  tx.detect_progress, tx.detect_progress_orig);
2708 
2709  StoreDetectProgress(&tx, flow_flags, tx.detect_progress);
2710  }
2711  next_tx_fw:
2712  InspectionBufferClean(det_ctx);
2713 
2714  next:
2715  if (!ires.has_next)
2716  break;
2717  }
2718 
2719  SCLogDebug("packet %" PRIu64 ": tx_inspected %u", PcapPacketCntGet(p), tx_inspected);
2720  if (have_fw_rules) {
2721  if (tx_inspected == 0) {
2722  /* if all tables have been bypassed, we accept:packet */
2723  SCLogDebug("default accept: no app inspect performed");
2724  DetectRunAppendDefaultAccept(det_ctx, p);
2725  } else if (last_tx_skipped) {
2726  /* if the last tx was skipped, we need to apply accept:packet */
2727  // TODO should we check drops first?
2728  DEBUG_VALIDATE_BUG_ON(p->action & ACTION_DROP);
2729  SCLogDebug("default accept: last tx skipped");
2730  DetectRunAppendDefaultAccept(det_ctx, p);
2731  }
2732  }
2733 }
2734 
2735 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2736  Packet *p, Flow *f, DetectRunScratchpad *scratch)
2737 {
2738  const SigGroupHead *const sgh = scratch->sgh;
2739  const AppProto alproto = f->alproto;
2740 
2741  /* for TCP, limit inspection to pseudo packets or real packet that did
2742  * an app-layer update. */
2743  if (p->proto == IPPROTO_TCP && !PKT_IS_PSEUDOPKT(p) &&
2744  ((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) ||
2745  (PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) {
2746  SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE",
2747  PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
2748  return;
2749  }
2750  FramesContainer *frames_container = AppLayerFramesGetContainer(f);
2751  if (frames_container == NULL) {
2752  return;
2753  }
2754  Frames *frames;
2755  if (PKT_IS_TOSERVER(p)) {
2756  frames = &frames_container->toserver;
2757  } else {
2758  frames = &frames_container->toclient;
2759  }
2760 
2761  for (uint32_t idx = 0; idx < frames->cnt; idx++) {
2762  SCLogDebug("frame %u", idx);
2763  Frame *frame = FrameGetByIndex(frames, idx);
2764  if (frame == NULL) {
2765  continue;
2766  }
2767 
2768  det_ctx->frame_inspect_progress = 0;
2769  uint32_t array_idx = 0;
2770  uint32_t total_rules = det_ctx->match_array_cnt;
2771 
2772  /* run prefilter engines and merge results into a candidates array */
2773  if (sgh->frame_engines) {
2774  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX);
2775  DetectRunPrefilterFrame(det_ctx, sgh, p, frames, frame, alproto);
2776  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX);
2777  SCLogDebug("%p/%" PRIi64 " rules added from prefilter: %u candidates", frame, frame->id,
2778  det_ctx->pmq.rule_id_array_cnt);
2779 
2780  total_rules += det_ctx->pmq.rule_id_array_cnt;
2781 
2782  if (!(RuleMatchCandidateTxArrayHasSpace(
2783  det_ctx, total_rules))) { // TODO is it safe to overload?
2784  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2785  }
2786 
2787  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
2788  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
2789  const SigIntId id = s->iid;
2790  det_ctx->tx_candidates[array_idx].s = s;
2791  det_ctx->tx_candidates[array_idx].id = id;
2792  det_ctx->tx_candidates[array_idx].flags = NULL;
2793  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2794  array_idx++;
2795  }
2796  PMQ_RESET(&det_ctx->pmq);
2797  }
2798  /* merge 'state' rules from the regular prefilter */
2799  uint32_t x = array_idx;
2800  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
2801  const Signature *s = det_ctx->match_array[i];
2802  if (s->frame_inspect != NULL) {
2803  const SigIntId id = s->iid;
2804  det_ctx->tx_candidates[array_idx].s = s;
2805  det_ctx->tx_candidates[array_idx].id = id;
2806  det_ctx->tx_candidates[array_idx].flags = NULL;
2807  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2808  array_idx++;
2809 
2810  SCLogDebug("%p/%" PRIi64 " rule %u (%u) added from 'match' list", frame, frame->id,
2811  s->id, id);
2812  }
2813  }
2814  SCLogDebug("%p/%" PRIi64 " rules added from 'match' list: %u", frame, frame->id,
2815  array_idx - x);
2816  (void)x;
2817 
2818  /* run rules: inspect the match candidates */
2819  for (uint32_t i = 0; i < array_idx; i++) {
2820  const Signature *s = det_ctx->tx_candidates[i].s;
2821 
2822  /* deduplicate: rules_array is sorted, but not deduplicated.
2823  * As they are back to back in that case we can check for it
2824  * here. We select the stored state one as that comes first
2825  * in the array. */
2826  while ((i + 1) < array_idx &&
2827  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
2828  i++;
2829  }
2830  SCLogDebug("%p/%" PRIi64 " inspecting: sid %u (%u)", frame, frame->id, s->id, s->iid);
2831 
2832  /* start new inspection */
2833  SCLogDebug("%p/%" PRIi64 " Start sid %u", frame, frame->id, s->id);
2834 
2835  /* call individual rule inspection */
2836  RULE_PROFILING_START(p);
2837  bool r = DetectRunInspectRuleHeader(p, f, s, s->flags);
2838  if (r) {
2839  r = DetectRunFrameInspectRule(tv, det_ctx, s, f, p, frames, frame);
2840  if (r) {
2841  /* match */
2842  DetectRunPostMatch(tv, det_ctx, p, s);
2843  det_ctx->frame_id = frame->id;
2844  SCLogDebug(
2845  "%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->iid);
2846  const uint8_t alert_flags =
2847  (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
2848  if (frame->flags & FRAME_FLAG_TX_ID_SET) {
2849  const uint8_t ipproto = p->proto;
2850  uint8_t sub_state = 0;
2851  void *tx = AppLayerParserGetTx(
2852  ipproto, alproto, p->flow->alstate, frame->tx_id);
2853  if (tx) {
2854  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
2855  sub_state = txd->tx_type;
2856  }
2857  AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, sub_state, alert_flags);
2858  } else {
2859  AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
2860  }
2861  }
2862  }
2863  DetectVarProcessList(det_ctx, p->flow, p);
2864  RULE_PROFILING_END(det_ctx, s, r, p);
2865  }
2866 
2867  /* update Frame::inspect_progress here instead of in the code above. The reason is that a
2868  * frame might be used more than once in buffers with transforms. */
2869  if (frame->inspect_progress < det_ctx->frame_inspect_progress) {
2870  frame->inspect_progress = det_ctx->frame_inspect_progress;
2871  SCLogDebug("frame->inspect_progress: %" PRIu64 " -> updated", frame->inspect_progress);
2872  } else {
2873  SCLogDebug(
2874  "frame->inspect_progress: %" PRIu64 " -> not updated", frame->inspect_progress);
2875  }
2876 
2877  SCLogDebug("%p/%" PRIi64 " rules inspected, running cleanup", frame, frame->id);
2878  InspectionBufferClean(det_ctx);
2879  }
2880 }
2881 
2882 static DetectEngineThreadCtx *GetTenantById(HashTable *h, uint32_t id)
2883 {
2884  /* technically we need to pass a DetectEngineThreadCtx struct with the
2885  * tenant_id member. But as that member is the first in the struct, we
2886  * can use the id directly. */
2887  return HashTableLookup(h, &id, 0);
2888 }
2889 
2890 static void DetectFlow(ThreadVars *tv,
2891  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2892  Packet *p)
2893 {
2894  Flow *const f = p->flow;
2895 
2896  /* we check the flow drop here, and not the packet drop. This is
2897  * to allow stream engine "invalid" drop packets to still be
2898  * evaluated by the stream event rules. */
2899  if (f->flags & FLOW_ACTION_DROP) {
2900  DEBUG_VALIDATE_BUG_ON(!(PKT_IS_PSEUDOPKT(p)) && !PacketCheckAction(p, ACTION_DROP));
2901  SCReturn;
2902  }
2903 
2904  /* in firewall mode, we still need to run the fw rulesets even for exception policy pass */
2905  bool skip = (p->flags & PKT_NOPACKET_INSPECTION || f->flags & (FLOW_ACTION_PASS));
2906  if (EngineModeIsFirewall() && (f->flags & FLOW_ACTION_ACCEPT) == 0) {
2907  skip = false;
2908  }
2909  if (skip) {
2910  /* enforce prior accept:flow */
2911  if (f->flags & FLOW_ACTION_ACCEPT) {
2912  p->action |= ACTION_ACCEPT;
2913  }
2914  /* hack: if we are in pass the entire flow mode, we need to still
2915  * update the inspect_id forward. So test for the condition here,
2916  * and call the update code if necessary. */
2917  const int pass = (f->flags & (FLOW_ACTION_PASS | FLOW_ACTION_ACCEPT));
2918  if (pass) {
2919  uint8_t flags = STREAM_FLAGS_FOR_PACKET(p);
2920  flags = FlowGetDisruptionFlags(f, flags);
2921  if (f->alstate) {
2922  AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true);
2923  }
2924  }
2925  SCLogDebug("p->pcap %" PRIu64 ": no detection on packet, "
2926  "PKT_NOPACKET_INSPECTION is set",
2927  PcapPacketCntGet(p));
2928  return;
2929  }
2930 
2931  /* see if the packet matches one or more of the sigs */
2932  DetectRun(tv, de_ctx, det_ctx, p);
2933 }
2934 
2935 
2936 static void DetectNoFlow(ThreadVars *tv,
2937  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2938  Packet *p)
2939 {
2940  /* No need to perform any detection on this packet, if the given flag is set.*/
2941  if ((p->flags & PKT_NOPACKET_INSPECTION) || (PacketCheckAction(p, ACTION_DROP))) {
2942  return;
2943  }
2944 
2945  /* see if the packet matches one or more of the sigs */
2946  DetectRun(tv, de_ctx, det_ctx, p);
2947 }
2948 
2949 uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
2950 {
2951  const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
2952  const SigGroupHead *sgh = de_ctx->pre_flow_sgh;
2953 
2954  SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
2955  DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p, DETECT_FIREWALL_POLICY_PRE_FLOW);
2956  return p->action;
2957 }
2958 
2959 uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
2960 {
2961  const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
2962  const int direction = (PKT_IS_TOCLIENT(p) != 0);
2963  const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction];
2964 
2965  SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
2966  DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p, DETECT_FIREWALL_POLICY_PRE_STREAM);
2967  return p->action;
2968 }
2969 
2970 /** \brief Detection engine thread wrapper.
2971  * \param tv thread vars
2972  * \param p packet to inspect
2973  * \param data thread specific data
2974  * \param pq packet queue
2975  * \retval TM_ECODE_FAILED error
2976  * \retval TM_ECODE_OK ok
2977  */
2978 TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
2979 {
2980  DEBUG_VALIDATE_PACKET(p);
2981 
2982  DetectEngineCtx *de_ctx = NULL;
2983  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
2984  if (det_ctx == NULL) {
2985  printf("ERROR: Detect has no thread ctx\n");
2986  goto error;
2987  }
2988 
2989  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
2990  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
2991  SCLogDebug("Detect Engine using new det_ctx - %p",
2992  det_ctx);
2993  }
2994 
2995  /* if in MT mode _and_ we have tenants registered, use
2996  * MT logic. */
2997  if (det_ctx->mt_det_ctxs_cnt > 0 && det_ctx->TenantGetId != NULL)
2998  {
2999  uint32_t tenant_id = p->tenant_id;
3000  if (tenant_id == 0)
3001  tenant_id = det_ctx->TenantGetId(det_ctx, p);
3002  if (tenant_id > 0 && tenant_id < det_ctx->mt_det_ctxs_cnt) {
3003  p->tenant_id = tenant_id;
3004  det_ctx = GetTenantById(det_ctx->mt_det_ctxs_hash, tenant_id);
3005  if (det_ctx == NULL)
3006  return TM_ECODE_OK;
3007  de_ctx = det_ctx->de_ctx;
3008  if (de_ctx == NULL)
3009  return TM_ECODE_OK;
3010 
3011  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
3012  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
3013  SCLogDebug("MT de_ctx %p det_ctx %p (tenant %u)", de_ctx, det_ctx, tenant_id);
3014  }
3015  } else {
3016  /* use default if no tenants are registered for this packet */
3017  de_ctx = det_ctx->de_ctx;
3018  }
3019  } else {
3020  de_ctx = det_ctx->de_ctx;
3021  }
3022 
3023  if (p->flow) {
3024  DetectFlow(tv, de_ctx, det_ctx, p);
3025  } else {
3026  DetectNoFlow(tv, de_ctx, det_ctx, p);
3027  }
3028 
3029 #ifdef PROFILE_RULES
3030  /* aggregate statistics */
3031  struct timeval ts;
3032  gettimeofday(&ts, NULL);
3033  if (ts.tv_sec != det_ctx->rule_perf_last_sync) {
3034  SCProfilingRuleThreatAggregate(det_ctx);
3035  det_ctx->rule_perf_last_sync = ts.tv_sec;
3036  }
3037 #endif
3038 
3039  return TM_ECODE_OK;
3040 error:
3041  return TM_ECODE_FAILED;
3042 }
3043 
3044 /** \brief disable file features we don't need
3045  * Called if we have no detection engine.
3046  */
3047 void DisableDetectFlowFileFlags(Flow *f)
3048 {
3049  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOSERVER);
3050  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOCLIENT);
3051 }
3052 
3053 #if defined(UNITTESTS) || defined(FUZZ)
3054 /**
3055  * \brief wrapper for old tests
3056  */
3057 void SigMatchSignatures(
3058  ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
3059 {
3060  if (p->flow) {
3061  DetectFlow(tv, de_ctx, det_ctx, p);
3062  } else {
3063  DetectNoFlow(tv, de_ctx, det_ctx, p);
3064  }
3065 }
3066 #endif
3067 
3068 /*
3069  * TESTS
3070  */
3071 
3072 #ifdef UNITTESTS
3073 #include "tests/detect.c"
3074 #endif
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:240
default_accept
thread_local Signature default_accept
Definition: detect.c:2060
DetectEngineAppInspectionEngine_::stream
bool stream
Definition: detect.h:424
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:50
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:143
RulesDumpTxMatchArray
void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt, const uint32_t pkt_prefilter_cnt)
Definition: detect-engine-profile.c:34
SIG_GROUP_HEAD_HAVEFILEMD5
#define SIG_GROUP_HEAD_HAVEFILEMD5
Definition: detect.h:1557
DETECT_TX_FW_FC_SKIP
@ DETECT_TX_FW_FC_SKIP
Definition: detect.c:1176
DetectFirewallPolicies
Definition: detect.h:954
PACKET_ALERT_FLAG_TX_GUESSED
#define PACKET_ALERT_FLAG_TX_GUESSED
Definition: decode.h:280
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:144
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1711
DetectEngineAppInspectionEngine_
Definition: detect.h:419
Packet_::proto
uint8_t proto
Definition: decode.h:538
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-prefilter.h:34
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:423
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:55
RuleMatchCandidateTx::stream_stored
bool stream_stored
Definition: detect.h:1265
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:53
DetectEngineThreadCtx_::alert_queue_size
uint16_t alert_queue_size
Definition: detect.h:1391
PROF_DETECT_GETSGH
@ PROF_DETECT_GETSGH
Definition: suricata-common.h:466
ts
uint64_t ts
Definition: source-erf-file.c:55
AppLayerTxData::flags
uint8_t flags
Definition: app-layer-parser.h:176
PacketAlerts_::firewall_discarded
uint16_t firewall_discarded
Definition: decode.h:291
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@82 v2
SCAppLayerParserStateIssetFlag
uint16_t SCAppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:2105
FLOW_ACTION_BY_FIREWALL
#define FLOW_ACTION_BY_FIREWALL
Definition: flow.h:126
detect-engine.h
detect-engine-proto.h
DetectEngineThreadCtx_::match_array_cnt
SigIntId match_array_cnt
Definition: detect.h:1405
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:52
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:91
DetectEngineThreadCtx_::counter_alerts
StatsCounterId counter_alerts
Definition: detect.h:1351
detect-dsize.h
Signature_::addr_src_match6
DetectMatchAddressIPv6 * addr_src_match6
Definition: detect.h:731
Flow_::flags
uint64_t flags
Definition: flow.h:404
SIG_FLAG_FW_HOOK_LTE
#define SIG_FLAG_FW_HOOK_LTE
Definition: detect.h:254
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1311
DetectEngineCtx_::decoder_event_sgh
struct SigGroupHead_ * decoder_event_sgh
Definition: detect.h:1076
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:285
DetectEngineCtx_::flow_gh
DetectEngineLookupFlow flow_gh[FLOW_STATES]
Definition: detect.h:1015
DETECT_TABLE_APP_FILTER
@ DETECT_TABLE_APP_FILTER
Definition: detect.h:566
DE_STATE_FLAG_SIG_CANT_MATCH
#define DE_STATE_FLAG_SIG_CANT_MATCH
Definition: detect-engine-state.h:59
DetectFirewallAppPolicy
Definition: detect.h:943
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:445
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
detect-engine-siggroup.h
SigGroupHead_::flags
uint16_t flags
Definition: detect.h:1700
PostRuleMatchWorkQueue::len
uint32_t len
Definition: detect.h:1289
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1364
DetectEngineState_
Definition: detect-engine-state.h:95
stream-tcp.h
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
detect-engine-event.h
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1699
PACKET_ALERT_FLAG_STATE_MATCH
#define PACKET_ALERT_FLAG_STATE_MATCH
Definition: decode.h:270
DetectEngineCtx_::guess_applayer
bool guess_applayer
Definition: detect.h:1038
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
detect.c
AppLayerTxData::tx_type
uint8_t tx_type
Definition: app-layer-parser.h:209
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
PKT_DROP_REASON_FW_RULES
@ PKT_DROP_REASON_FW_RULES
Definition: decode.h:407
Signature_::app_progress_hook
uint8_t app_progress_hook
Definition: detect.h:725
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(const Flow *f)
Definition: app-layer-parser.c:201
KEYWORD_PROFILING_SET_LIST
#define KEYWORD_PROFILING_SET_LIST(ctx, list)
Definition: util-profiling.h:46
DetectAddressMatchIPv4
int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1604
PcapPacketCntGet
uint64_t PcapPacketCntGet(const Packet *p)
Definition: decode.c:1180
DetectEngineAppInspectionEngine_::Callback
InspectEngineFuncPtr Callback
Definition: detect.h:438
Signature_::alproto
AppProto alproto
Definition: detect.h:693
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:75
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:836
DETECT_TX_FW_FC_OK
@ DETECT_TX_FW_FC_OK
Definition: detect.c:1175
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:89
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:775
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SigMatchData_::is_last
bool is_last
Definition: detect.h:370
AppLayerTxData::de_state
DetectEngineState * de_state
Definition: app-layer-parser.h:217
InspectionBufferClean
void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-inspect-buffer.c:30
Flow_::proto
uint8_t proto
Definition: flow.h:377
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:87
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:289
DetectEngineThreadCtx_::tx_id
uint64_t tx_id
Definition: detect.h:1382
SCFlowGetAppProtocol
AppProto SCFlowGetAppProtocol(const Flow *f)
Definition: flow.c:1278
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:371
AppLayerParserGetStateProgressCompletionStatus
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1252
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:135
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:72
Packet_::flags
uint32_t flags
Definition: decode.h:562
Packet_::action
uint8_t action
Definition: decode.h:624
ICMPV4_DEST_UNREACH_IS_VALID
#define ICMPV4_DEST_UNREACH_IS_VALID(p)
Definition: decode-icmpv4.h:253
Frame
Definition: app-layer-frames.h:43
Flow_
Flow data structure.
Definition: flow.h:355
DetectFirewallPacketPolicies
DetectFirewallPacketPolicies
Definition: detect.h:930
PROF_DETECT_ALERT
@ PROF_DETECT_ALERT
Definition: suricata-common.h:477
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1414
SIG_GROUP_HEAD_HAVEFILESHA1
#define SIG_GROUP_HEAD_HAVEFILESHA1
Definition: detect.h:1559
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its normalized string equivalent.
Definition: app-layer-protos.c:51
FLOW_TC_APP_UPDATED
#define FLOW_TC_APP_UPDATED
Definition: flow.h:120
th_v
ThreadVars * th_v
Definition: fuzz_iprep.c:20
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:987
DetectEngineCtx_::pre_stream_sgh
struct SigGroupHead_ * pre_stream_sgh[2]
Definition: detect.h:1217
DETECT_PROTO_ETHERNET
#define DETECT_PROTO_ETHERNET
Definition: detect-engine-proto.h:33
DetectRunScratchpad
struct DetectRunScratchpad DetectRunScratchpad
DetectFirewallAppPolicy::policy
struct DetectFirewallPolicy policy
Definition: detect.h:948
PROF_DETECT_PF_TX
@ PROF_DETECT_PF_TX
Definition: suricata-common.h:472
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:59
Frame::id
int64_t id
Definition: app-layer-frames.h:51
DetectFirewallPolicies::pkt_policy_signatures
Signature * pkt_policy_signatures[DETECT_FIREWALL_POLICY_SIZE]
Definition: detect.h:957
DetectEngineThreadCtx_::p
Packet * p
Definition: detect.h:1386
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:96
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:145
RuleMatchCandidateTx::id
SigIntId id
Definition: detect.h:1261
PROF_DETECT_CLEANUP
@ PROF_DETECT_CLEANUP
Definition: suricata-common.h:479
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:244
ACTION_SCOPE_FLOW
@ ACTION_SCOPE_FLOW
Definition: action-globals.h:45
NO_TX
#define NO_TX
Definition: detect.c:1559
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:232
HashTable_
Definition: util-hash.h:35
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:252
MIN
#define MIN(x, y)
Definition: suricata-common.h:416
Packet_::sig_mask
SignatureMask sig_mask
Definition: decode.h:553
Frames
Definition: app-layer-frames.h:58
FramesContainer
Definition: app-layer-frames.h:71
DetectFirewallAppTxState::fw_skip_app_filter
bool fw_skip_app_filter
Definition: detect.c:1717
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:296
DetectEngineThreadCtx_::counter_alerts_overflow
StatsCounterId counter_alerts_overflow
Definition: detect.h:1353
DetectRunScratchpad
Definition: detect.c:70
SIG_GROUP_HEAD_HAVERAWSTREAM
#define SIG_GROUP_HEAD_HAVERAWSTREAM
Definition: detect.h:1553
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:70
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
FLOWFILE_NONE
#define FLOWFILE_NONE
Definition: flow.h:167
detect-engine-frame.h
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:3057
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:751
proto
uint8_t proto
Definition: decode-template.h:0
m
SCMutex m
Definition: flow-hash.h:6
DetectPort_::sh
struct SigGroupHead_ * sh
Definition: detect.h:233
p
Packet * p
Definition: fuzz_iprep.c:21
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1297
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:221
DetectEngineThreadCtx_::counter_alerts_suppressed
StatsCounterId counter_alerts_suppressed
Definition: detect.h:1357
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:2978
detect-engine-payload.h
DetectEngineThreadCtx_::counter_firewall_discarded_alerts
StatsCounterId counter_firewall_discarded_alerts
Definition: detect.h:1355
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:547
EngineModeIsFirewall
bool EngineModeIsFirewall(void)
Definition: suricata.c:239
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:243
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
DetectRunFrameInspectRule
bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
Definition: detect-engine-frame.c:229
Flow_::protoctx
void * protoctx
Definition: flow.h:434
DetectFirewallAppTxState::skip_before_progress
uint8_t skip_before_progress
Definition: detect.c:1719
AppLayerGetTxIterTuple::tx_ptr
void * tx_ptr
Definition: app-layer-parser.h:154
SigMatchData_
Data needed for Match()
Definition: detect.h:368
DetectFirewallAppPolicy::alert_signature
Signature * alert_signature
Definition: detect.h:951
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:77
AppLayerTxData::tx_type_eop_ts
uint8_t tx_type_eop_ts
Definition: app-layer-parser.h:213
RuleMatchCandidateTx::s
const Signature * s
Definition: detect.h:1271
KEYWORD_PROFILING_START
#define KEYWORD_PROFILING_START
Definition: util-profiling.h:50
SigMatchData_::type
uint16_t type
Definition: detect.h:369
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:1072
DetectFirewallPolicy::action
uint8_t action
Definition: detect.h:939
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:3047
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:805
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:637
detect-engine-prefilter.h
DetectRunPrefilterFrame
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
Definition: detect-engine-frame.c:74
Packet_::events
PacketEngineEvents events
Definition: decode.h:643
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:747
PROF_DETECT_PF_SORT2
@ PROF_DETECT_PF_SORT2
Definition: suricata-common.h:475
pad
uint16_t pad
Definition: source-erf-file.c:61
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
PacketCreateMask
void PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, bool app_decoder_events)
Definition: detect-engine-build.c:406
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:251
KEYWORD_PROFILING_END
#define KEYWORD_PROFILING_END(ctx, type, m)
Definition: util-profiling.h:64
detect-flowvar.h
DetectEngineThreadCtx_::mt_det_ctxs_hash
HashTable * mt_det_ctxs_hash
Definition: detect.h:1318
PacketAlert_::action
uint8_t action
Definition: decode.h:251
TcpSession_::flags
uint32_t flags
Definition: stream-tcp-private.h:294
DetectEnginePktInspectionRun
bool DetectEnginePktInspectionRun(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
Definition: detect-engine.c:1979
SIG_FLAG_FIREWALL
#define SIG_FLAG_FIREWALL
Definition: detect.h:248
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:487
PROF_DETECT_TX_UPDATE
@ PROF_DETECT_TX_UPDATE
Definition: suricata-common.h:478
DetectEngineAppInspectionEngine_::id
uint8_t id
Definition: detect.h:422
DetectRunStoreStateTx
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
Definition: detect-engine-state.c:213
StatsCounterAvgAddI64
void StatsCounterAvgAddI64(StatsThreadContext *stats, StatsCounterAvgId id, int64_t x)
Definition: counters.c:239
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:427
FLOWFILE_INIT
#define FLOWFILE_INIT
Definition: flow.h:132
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:479
FLOW_ACTION_PASS
#define FLOW_ACTION_PASS
Definition: flow.h:117
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
Definition: detect-engine-state.h:46
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:148
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:127
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:73
DetectEngineCtx_::pre_flow_sgh
struct SigGroupHead_ * pre_flow_sgh
Definition: detect.h:1222
DetectEngineThreadCtx_::tx_candidates
RuleMatchCandidateTx * tx_candidates
Definition: detect.h:1407
SIG_TYPE_PKT
@ SIG_TYPE_PKT
Definition: detect.h:72
Signature_::addr_src_match4
DetectMatchAddressIPv4 * addr_src_match4
Definition: detect.h:728
decode.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:52
DetectEngineCtx_::fw_policies
struct DetectFirewallPolicies * fw_policies
Definition: detect.h:1018
DETECT_PROTO_ARP
#define DETECT_PROTO_ARP
Definition: detect-engine-proto.h:34
TOSERVER
#define TOSERVER
Definition: flow.h:46
DetectTransaction_::tx_end_state
const uint8_t tx_end_state
Definition: detect-engine-prefilter.h:44
DetectEngineThreadCtx_::counter_mpm_list
StatsCounterAvgId counter_mpm_list
Definition: detect.h:1359
AppLayerTxData
Definition: app-layer-parser.h:166
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:239
DetectFirewallAppTxState::skip_fw_hook
bool skip_fw_hook
Definition: detect.c:1718
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
Definition: detect-engine-prefilter.c:237
DetectTransaction_::detect_progress_orig
const uint8_t detect_progress_orig
Definition: detect-engine-prefilter.h:41
DetectEngineThreadCtx_
Definition: detect.h:1306
DEBUG_VALIDATE_PACKET
#define DEBUG_VALIDATE_PACKET(p)
Definition: util-validate.h:108
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:76
PKT_STREAM_ADD
#define PKT_STREAM_ADD
Definition: decode.h:1305
DetectTransaction_::detect_progress
uint8_t detect_progress
Definition: detect-engine-prefilter.h:39
AlertQueueAppendAppTxFromPacket
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing This does not automatically set ...
Definition: detect-engine-alert.c:437
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:425
DetectEngineThreadCtx_::tx_candidates_size
uint32_t tx_candidates_size
Definition: detect.h:1408
FRAME_FLAG_TX_ID_SET
#define FRAME_FLAG_TX_ID_SET
Definition: app-layer-frames.h:36
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1313
DETECT_TX_FW_FC_BREAK
@ DETECT_TX_FW_FC_BREAK
Definition: detect.c:1177
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1335
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:542
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
PMQ_RESET
#define PMQ_RESET(pmq)
Definition: util-prefilter.h:46
detect-engine-mpm.h
DetectEngineLookupFlow_::sgh
struct SigGroupHead_ * sgh[256]
Definition: detect.h:886
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:194
AppLayerGetTxIterTuple::tx_id
uint64_t tx_id
Definition: app-layer-parser.h:155
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:82
DetectTransaction_::is_last
bool is_last
Definition: detect-engine-prefilter.h:45
Packet_::sp
Port sp
Definition: decode.h:523
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:151
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:41
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1350
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:236
DetectFirewallPolicies::pkt
struct DetectFirewallPolicy pkt[DETECT_FIREWALL_POLICY_SIZE]
Definition: detect.h:956
StreamReassembleRawHasDataReady
bool StreamReassembleRawHasDataReady(TcpSession *ssn, Packet *p)
does the stream engine have data to inspect?
Definition: stream-tcp-reassemble.c:1499
detect-engine-port.h
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:881
DetectFirewallAppPolicy::progress
uint8_t progress
Definition: detect.h:946
DetectPort_
Port structure for detection engine.
Definition: detect.h:222
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:290
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:745
ThreadVars_::id
int id
Definition: threadvars.h:86
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *tx, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1225
util-detect.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:325
detect-engine-profile.h
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:484
DetectEngineThreadCtx_::base64_decoded_len
int base64_decoded_len
Definition: detect.h:1389
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:269
RuleMatchCandidateTx::stream_result
uint8_t stream_result
Definition: detect.h:1266
Signature_::action
uint8_t action
Definition: detect.h:703
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-prefilter.h:33
DetectEngineLookupFlow_::udp
DetectPort * udp
Definition: detect.h:885
DetectEngineThreadCtx_::raw_stream_progress
uint64_t raw_stream_progress
Definition: detect.h:1327
SigIntId
#define SigIntId
Definition: detect-engine-state.h:38
FileUpdateFlowFileFlags
void FileUpdateFlowFileFlags(Flow *f, uint16_t set_file_flags, uint8_t direction)
set a flow's file flags
Definition: util-file.c:1091
SCReturn
#define SCReturn
Definition: util-debug.h:286
Signature_::flags
uint32_t flags
Definition: detect.h:689
RuleMatchCandidateTxArrayFree
void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
Definition: detect.c:1193
AppLayerGetTxIterState
Definition: app-layer-parser.h:142
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
Packet_
Definition: decode.h:516
detect-engine-build.h
ACTION_SCOPE_TX
@ ACTION_SCOPE_TX
Definition: action-globals.h:47
DetectEngineThreadCtx_::frame_id
int64_t frame_id
Definition: detect.h:1383
detect-engine-alert.h
AppLayerTxData::guessed_applayer_logged
uint8_t guessed_applayer_logged
Definition: app-layer-parser.h:196
DetectEngineThreadCtx_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1348
PROF_DETECT_IPONLY
@ PROF_DETECT_IPONLY
Definition: suricata-common.h:467
RULE_PROFILING_END
#define RULE_PROFILING_END(a, b, c, p)
Definition: util-profiling.h:422
TmEcode
TmEcode
Definition: tm-threads-common.h:80
RULE_PROFILING_START
#define RULE_PROFILING_START(p)
Definition: util-profiling.h:421
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:300
DetectPreFlow
uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
Definition: detect.c:2949
DetectTransaction_::de_state
DetectEngineStateDirection * de_state
Definition: detect-engine-prefilter.h:35
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1486
DetectTransaction_::tx_type
const uint8_t tx_type
Definition: detect-engine-prefilter.h:48
DetectFirewallAppTxState::last_fw_rule
bool last_fw_rule
Definition: detect.c:1722
detect-replace.h
AppLayerGetTxIterTuple
Definition: app-layer-parser.h:153
RulesDumpMatchArray
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p)
Definition: detect-engine-profile.c:81
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
Signature_::addr_dst_match6_cnt
uint16_t addr_dst_match6_cnt
Definition: detect.h:715
AppLayerTxData::detect_progress_ts
uint8_t detect_progress_ts
Definition: app-layer-parser.h:204
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:233
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1712
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:292
Signature_::sp
DetectPort * sp
Definition: detect.h:739
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1245
DetectRunScratchpad::sgh
const SigGroupHead * sgh
Definition: detect.c:75
PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET
#define PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET
Definition: decode.h:282
DETECT_FIREWALL_POLICY_PRE_STREAM
@ DETECT_FIREWALL_POLICY_PRE_STREAM
Definition: detect.h:933
PacketAlertFinalize
void PacketAlertFinalize(const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
Check the threshold of the sigs that match, set actions, break on pass action This function iterate t...
Definition: detect-engine-alert.c:831
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
Definition: detect-engine-state.h:42
DETECT_ENGINE_STATE_FLAG_FILE_NEW
#define DETECT_ENGINE_STATE_FLAG_FILE_NEW
Definition: detect-engine-state.h:73
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:490
RuleMatchCandidateTx::flags
uint32_t * flags
Definition: detect.h:1262
PACKET_ALERT_FLAG_FRAME
#define PACKET_ALERT_FLAG_FRAME
Definition: decode.h:278
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:45
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:420
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-analyzer.h
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:152
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:86
DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
#define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
Definition: detect-engine-state.h:52
DetectEngineCtx_::eth_non_ip_sgh
struct SigGroupHead_ * eth_non_ip_sgh
Definition: detect.h:1079
APP_LAYER_MAX_PROGRESS
#define APP_LAYER_MAX_PROGRESS
Definition: app-layer-parser.h:75
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:40
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
app-layer-frames.h
DetectAddressMatchIPv6
int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1637
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:678
Packet_::flow
struct Flow_ * flow
Definition: decode.h:564
DetectEngineStateResetTxs
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
Definition: detect-engine-state.c:259
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:136
flags
uint8_t flags
Definition: decode-gre.h:0
SCGenericVarFree
void SCGenericVarFree(GenericVar *gv)
Definition: util-var.c:48
suricata-common.h
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:245
ActionScope
ActionScope
Definition: action-globals.h:42
DETECT_FIREWALL_POLICY_PACKET_FILTER
@ DETECT_FIREWALL_POLICY_PACKET_FILTER
Definition: detect.h:931
AppLayerTxData::updated_tc
bool updated_tc
Definition: app-layer-parser.h:173
ACTION_SCOPE_HOOK
@ ACTION_SCOPE_HOOK
Definition: action-globals.h:46
Signature_::action_scope
uint8_t action_scope
Definition: detect.h:710
packet.h
DeStateStore_
Definition: detect-engine-state.h:80
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectTransaction_
Definition: detect-engine-prefilter.h:31
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:550
PROF_DETECT_SETUP
@ PROF_DETECT_SETUP
Definition: suricata-common.h:465
DetectEngineStateDirection_
Definition: detect-engine-state.h:85
DetectEngineThreadCtx_::frame_inspect_progress
uint64_t frame_inspect_progress
Definition: detect.h:1384
DetectEngineCtx_::profile_match_logging_threshold
uint32_t profile_match_logging_threshold
Definition: detect.h:1111
FLOW_TS_APP_UPDATED
#define FLOW_TS_APP_UPDATED
Definition: flow.h:119
Signature_::proto
DetectProto * proto
Definition: detect.h:707
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1446
FatalError
#define FatalError(...)
Definition: util-debug.h:517
DetectFirewallAppTxState::fw_next_progress_missing
bool fw_next_progress_missing
Definition: detect.c:1721
AppLayerTxData::tx_type_eop_tc
uint8_t tx_type_eop_tc
toclient end of tx progress value
Definition: app-layer-parser.h:215
AppLayerTxData::detect_progress_tc
uint8_t detect_progress_tc
Definition: app-layer-parser.h:205
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:33
DetectFirewallAppTxState
Definition: detect.c:1716
AlertQueueAppendPacket
void AlertQueueAppendPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing.
Definition: detect-engine-alert.c:447
FLOW_ACTION_ACCEPT
#define FLOW_ACTION_ACCEPT
Definition: flow.h:64
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-prefilter.h:32
Signature_::addr_src_match6_cnt
uint16_t addr_src_match6_cnt
Definition: detect.h:716
StreamReassembleRawUpdateProgress
void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_t progress)
update stream engine after detection
Definition: stream-tcp-reassemble.c:1545
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:147
PROF_DETECT_RULES
@ PROF_DETECT_RULES
Definition: suricata-common.h:468
APP_LAYER_TX_INSPECTED_TS
#define APP_LAYER_TX_INSPECTED_TS
Definition: app-layer-parser.h:51
DetectRunScratchpad::app_decoder_events
const bool app_decoder_events
Definition: detect.c:73
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
Signature_::dp
DetectPort * dp
Definition: detect.h:739
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:292
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:214
DetectEngineThreadCtx_::replace
const Signature ** replace
Definition: detect.h:1400
DetectFirewallPolicy
Definition: detect.h:938
PKT_PSEUDO_DETECTLOG_FLUSH
#define PKT_PSEUDO_DETECTLOG_FLUSH
Definition: decode.h:1353
Signature_::iid
SigIntId iid
Definition: detect.h:700
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:73
APP_LAYER_TX_ACCEPT
#define APP_LAYER_TX_ACCEPT
Definition: app-layer-parser.h:54
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:626
DetectEngineAppInspectionEngine_::sub_state
uint8_t sub_state
Definition: detect.h:430
SGH_PROFILING_RECORD
#define SGH_PROFILING_RECORD(det_ctx, sgh)
Definition: util-profiling.h:252
Signature_::addr_dst_match6
DetectMatchAddressIPv6 * addr_dst_match6
Definition: detect.h:730
Flow_::alstate
void * alstate
Definition: flow.h:480
Signature_::id
uint32_t id
Definition: detect.h:733
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:81
DetectEngineCtx_::guess_applayer_log_limit
uint8_t guess_applayer_log_limit
Definition: detect.h:1035
RuleMatchCandidateTx::stream_reset
uint32_t stream_reset
Definition: detect.h:1268
ACTION_SCOPE_PACKET
@ ACTION_SCOPE_PACKET
Definition: action-globals.h:44
detect-engine-iponly.h
detect-parse.h
Signature_
Signature container.
Definition: detect.h:688
AppLayerGetTxIterTuple::has_next
bool has_next
Definition: app-layer-parser.h:156
PACKET_ALERT_FLAG_TX
#define PACKET_ALERT_FLAG_TX
Definition: decode.h:274
DetectFirewallAppTxState::fw_last_for_progress
bool fw_last_for_progress
Definition: detect.c:1720
PKT_DROP_REASON_FW_DEFAULT_APP_POLICY
@ PKT_DROP_REASON_FW_DEFAULT_APP_POLICY
Definition: decode.h:409
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
TRACE_SID_TXS
#define TRACE_SID_TXS(sid, txs,...)
Definition: detect.c:1256
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:234
DetectEngineThreadCtx_::tx_id_set
bool tx_id_set
Definition: detect.h:1380
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:34
ACTION_ACCEPT
#define ACTION_ACCEPT
Definition: action-globals.h:36
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:201
DetectRunScratchpad::flow_flags
const uint8_t flow_flags
Definition: detect.c:72
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1429
suricata.h
IPOnlyMatchPacket
void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineIPOnlyCtx *io_ctx, Packet *p)
Match a packet against the IP Only detection engine contexts.
Definition: detect-engine-iponly.c:1000
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:1006
Packet_::dst
Address dst
Definition: decode.h:521
DETECT_FIREWALL_POLICY_PRE_FLOW
@ DETECT_FIREWALL_POLICY_PRE_FLOW
Definition: detect.h:932
PROF_DETECT_TX
@ PROF_DETECT_TX
Definition: suricata-common.h:469
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:421
Signature_::detect_table
uint8_t detect_table
Definition: detect.h:722
PKT_NOPACKET_INSPECTION
#define PKT_NOPACKET_INSPECTION
Definition: decode.h:1292
PrefilterPostRuleMatch
void PrefilterPostRuleMatch(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, Flow *f)
invoke post-rule match "prefilter" engines
Definition: detect-engine-prefilter.c:214
DetectGetInnerTx
void * DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
Definition: detect.c:1266
DetectPreStream
uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
Definition: detect.c:2959
PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY
@ PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY
Definition: decode.h:408
DetectRunScratchpad::alproto
const AppProto alproto
Definition: detect.c:71
DE_STATE_FLAG_FULL_INSPECT
#define DE_STATE_FLAG_FULL_INSPECT
Definition: detect-engine-state.h:58
STREAMTCP_STREAM_FLAG_DISABLE_RAW
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW
Definition: stream-tcp-private.h:238
DetectEngineThreadCtx_::json_content_len
uint8_t json_content_len
Definition: detect.h:1345
DetectEngineThreadCtx_::mt_det_ctxs_cnt
uint32_t mt_det_ctxs_cnt
Definition: detect.h:1316
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:226
likely
#define likely(expr)
Definition: util-optimize.h:32
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1273
DE_STATE_FLAG_FILE_INSPECT
#define DE_STATE_FLAG_FILE_INSPECT
Definition: detect-engine-state.h:63
DetectEngineThreadCtx_::counter_match_list
StatsCounterAvgId counter_match_list
Definition: detect.h:1360
AppLayerParserSupportsSubStates
bool AppLayerParserSupportsSubStates(const AppProto alproto)
Definition: app-layer-parser.c:1382
DetectFirewallAppPolicy::alproto
AppProto alproto
Definition: detect.h:944
DetectFirewallPolicies::app_policies
HashTable * app_policies
Definition: detect.h:960
DetectTransaction_::tx_progress
const uint8_t tx_progress
Definition: detect-engine-prefilter.h:43
DetectEngineCtx_::io_ctx
DetectEngineIPOnlyCtx io_ctx
Definition: detect.h:1029
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
Signature_::addr_dst_match4
DetectMatchAddressIPv4 * addr_dst_match4
Definition: detect.h:727
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1170
TcpSession_
Definition: stream-tcp-private.h:283
DetectRunScratchpad::fw_pkt_policy
enum DetectFirewallPacketPolicies fw_pkt_policy
Definition: detect.c:74
flow.h
Signature_::addr_src_match4_cnt
uint16_t addr_src_match4_cnt
Definition: detect.h:714
DetectFirewallPolicy::action_scope
uint8_t action_scope
Definition: detect.h:940
DetectTxFirewallFlowControl
DetectTxFirewallFlowControl
Definition: detect.c:1174
DeStateStoreItem_
Definition: detect-engine-state.h:75
Signature_::addr_dst_match4_cnt
uint16_t addr_dst_match4_cnt
Definition: detect.h:713
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:451
Packet_::dp
Port dp
Definition: decode.h:531
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectEngineCtx_::sig_array_len
uint32_t sig_array_len
Definition: detect.h:1007
SIG_GROUP_HEAD_HAVEFILESHA256
#define SIG_GROUP_HEAD_HAVEFILESHA256
Definition: detect.h:1560
AlertQueueAppendAppTx
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id, uint8_t sub_state, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing.
Definition: detect-engine-alert.c:425
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
Signature_::type
enum SignatureType type
Definition: detect.h:691
StatsCounterAddI64
void StatsCounterAddI64(StatsThreadContext *stats, StatsCounterId id, int64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:145
SigGroupHead_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1705
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1238
DetectFirewallAppPolicy::direction
uint8_t direction
Definition: detect.h:947
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1773
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:235
DetectEngineLookupFlow_::tcp
DetectPort * tcp
Definition: detect.h:884
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
detect-engine-address.h
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:425
Packet_::src
Address src
Definition: decode.h:520
SigMatchSignaturesGetSgh
const SigGroupHead * SigMatchSignaturesGetSgh(const DetectEngineCtx *de_ctx, const Packet *p)
Get the SigGroupHead for a packet.
Definition: detect.c:293
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:95
RuleMatchCandidateTxArrayInit
void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
Definition: detect.c:1180
APP_LAYER_TX_INSPECTED_TC
#define APP_LAYER_TX_INSPECTED_TC
Definition: app-layer-parser.h:52
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:246
DetectPortLookupGroup
DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port)
Function that find the group matching port in a group head.
Definition: detect-engine-port.c:585
DetectEngineThreadCtx_::post_rule_work_queue
PostRuleMatchWorkQueue post_rule_work_queue
Definition: detect.h:1412
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1307
detect-engine-threshold.h
Signature_::mask
SignatureMask mask
Definition: detect.h:699
AppLayerTxData::updated_ts
bool updated_ts
Definition: app-layer-parser.h:174
app-layer.h
RuleMatchCandidateTx
Definition: detect.h:1260
DetectEngineThreadCtx_::TenantGetId
uint32_t(* TenantGetId)(const void *, const Packet *p)
Definition: detect.h:1323
DetectEngineAppInspectionEngine_::progress
uint8_t progress
Definition: detect.h:429
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:310
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:465
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:115
DetectEngineThreadCtx_::match_array
Signature ** match_array
Definition: detect.h:1397