suricata
detect.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Basic detection engine
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 
29 #include "decode.h"
30 #include "packet.h"
31 #include "flow.h"
32 #include "flow-bindgen.h"
33 #include "stream-tcp.h"
34 #include "app-layer.h"
35 #include "app-layer-parser.h"
36 #include "app-layer-frames.h"
37 
38 #include "detect.h"
39 #include "detect-parse.h"
40 #include "detect-dsize.h"
41 #include "detect-engine.h"
42 #include "detect-engine-build.h"
43 #include "detect-engine-frame.h"
44 #include "detect-engine-profile.h"
45 
46 #include "detect-engine-alert.h"
47 #include "detect-engine-siggroup.h"
48 #include "detect-engine-address.h"
49 #include "detect-engine-proto.h"
50 #include "detect-engine-port.h"
51 #include "detect-engine-mpm.h"
52 #include "detect-engine-iponly.h"
53 #include "detect-engine-threshold.h"
54 #include "detect-engine-prefilter.h"
55 #include "detect-engine-state.h"
56 #include "detect-engine-analyzer.h"
57 
58 #include "detect-engine-payload.h"
59 #include "detect-engine-event.h"
60 
61 #include "detect-filestore.h"
62 #include "detect-flowvar.h"
63 #include "detect-replace.h"
64 
65 #include "util-validate.h"
66 #include "util-detect.h"
67 #include "util-profiling.h"
68 
69 #include "action-globals.h"
70 
71 typedef struct DetectRunScratchpad {
72  const AppProto alproto;
73  const uint8_t flow_flags; /* flow/state flags: STREAM_* */
74  const bool app_decoder_events;
75  const enum DetectFirewallPacketPolicies fw_pkt_policy;
76  const SigGroupHead *sgh;
77 } DetectRunScratchpad;
78 
79 /* prototypes */
80 static DetectRunScratchpad DetectRunSetup(const DetectEngineCtx *de_ctx,
81  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
82  const enum DetectFirewallPacketPolicies fw_pkt_policy);
83 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
84  DetectEngineThreadCtx *det_ctx, Flow * const pflow, Packet * const p);
85 static inline void DetectRunGetRuleGroup(const DetectEngineCtx *de_ctx,
86  Packet * const p, Flow * const pflow, DetectRunScratchpad *scratch);
87 static inline void DetectRunPrefilterPkt(ThreadVars *tv, const DetectEngineCtx *de_ctx,
88  DetectEngineThreadCtx *det_ctx, Packet *p, DetectRunScratchpad *scratch);
89 static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
90  const DetectEngineCtx *const de_ctx, DetectEngineThreadCtx *const det_ctx, Packet *const p,
91  Flow *const pflow, const DetectRunScratchpad *scratch);
92 static void DetectRunTx(ThreadVars *tv, DetectEngineCtx *de_ctx,
93  DetectEngineThreadCtx *det_ctx, Packet *p,
94  Flow *f, DetectRunScratchpad *scratch);
95 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
96  Packet *p, Flow *f, DetectRunScratchpad *scratch);
97 static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_ctx,
98  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
99  DetectRunScratchpad *scratch);
100 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
101  Packet *p, Flow * const pflow);
102 static inline void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet *p);
103 
104 /** \internal
105  */
106 static void DetectRun(ThreadVars *th_v,
107  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
108  Packet *p)
109 {
110  SCEnter();
111  SCLogDebug("pcap_cnt %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
112  p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
113  : "noflow",
114  PktSrcToString(p->pkt_src));
115 
116  /* Load the Packet's flow early, even though it might not be needed.
117  * Mark as a constant pointer, although the flow itself can change. */
118  Flow * const pflow = p->flow;
119 
120  DetectRunScratchpad scratch =
121  DetectRunSetup(de_ctx, det_ctx, p, pflow, DETECT_FIREWALL_POLICY_PACKET_FILTER);
122 
123  /* run the IPonly engine */
124  DetectRunInspectIPOnly(th_v, de_ctx, det_ctx, pflow, p);
125 
126  /* get our rule group */
127  DetectRunGetRuleGroup(de_ctx, p, pflow, &scratch);
128  /* if we didn't get a sig group head, we
129  * have nothing to do.... */
130  if (scratch.sgh == NULL) {
131  if (!EngineModeIsFirewall()) {
132  SCLogDebug("no sgh for this packet, nothing to match against");
133  goto end;
134  }
135  SCLogDebug(
136  "packet %" PRIu64 ": no sgh, need to apply default policies", PcapPacketCntGet(p));
137  } else {
138  /* run the prefilters for packets */
139  DetectRunPrefilterPkt(th_v, de_ctx, det_ctx, p, &scratch);
140  }
141  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES);
142  /* inspect the rules against the packet */
143  const uint8_t pkt_policy = DetectRulePacketRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
144  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
145  SCLogDebug("packet %" PRIu64 ": pkt_policy %02x (p->action %02x)", PcapPacketCntGet(p),
146  pkt_policy, p->action);
147 
148  /* Only FW rules will already have set the action, IDS rules go through PacketAlertFinalize
149  *
150  * If rules told us to drop or accept:packet/accept:flow, we skip app_filter and app_td.
151  *
152  * accept:hook won't have set the pkt_policy, so we simply continue.
153  *
154  * TODO what about app state progression, cleanup and such? */
155  if (pkt_policy & (ACTION_DROP | ACTION_ACCEPT)) {
156  goto end;
157  }
158 
159  /* run tx/state inspection. Don't call for ICMP error msgs. */
160  if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) {
161  if (p->proto == IPPROTO_TCP) {
162  if ((p->flags & PKT_STREAM_EST) == 0) {
163  SCLogDebug("packet %" PRIu64 ": skip tcp non-established", PcapPacketCntGet(p));
164  if (EngineModeIsFirewall()) {
165  SCLogDebug("default accept: no PKT_STREAM_EST");
166  DetectRunAppendDefaultAccept(det_ctx, p);
167  }
168  goto end;
169  }
170  const TcpSession *ssn = p->flow->protoctx;
171  bool setting_nopayload = p->flow->alparser &&
172  SCAppLayerParserStateIssetFlag(
173  p->flow->alparser, APP_LAYER_PARSER_NO_INSPECTION) &&
174  !(p->flags & PKT_NOPAYLOAD_INSPECTION);
175  // we may be right after disabling app-layer (ssh)
176  if (ssn &&
177  ((ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) == 0 || setting_nopayload)) {
178  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
179  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
180  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);
181  }
182  // no update to transactions
183  if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 &&
184  ((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) ||
185  (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) {
186  SCLogDebug("packet %" PRIu64 ": no app-layer update", PcapPacketCntGet(p));
187  if (EngineModeIsFirewall()) {
188  SCLogDebug("default accept: no app update");
189  DetectRunAppendDefaultAccept(det_ctx, p);
190  }
191  goto end;
192  }
193  } else if (p->proto == IPPROTO_UDP) {
194  DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
195  }
196 
197  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
198  DetectRunTx(th_v, de_ctx, det_ctx, p, pflow, &scratch);
199  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);
200  /* see if we need to increment the inspect_id and reset the de_state */
201  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX_UPDATE);
202  AppLayerParserSetTransactionInspectId(
203  pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL));
204  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE);
205  } else {
206  SCLogDebug("packet %" PRIu64 ": no flow / app-layer", PcapPacketCntGet(p));
207  if (EngineModeIsFirewall()) {
208  SCLogDebug("default accept: no flow/app");
209  DetectRunAppendDefaultAccept(det_ctx, p);
210  }
211  }
212 
213 end:
214  DetectRunPostRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
215 
216  DetectRunCleanup(det_ctx, p, pflow);
217  SCReturn;
218 }
219 
220 /** \internal
221  */
222 static void DetectRunPacketHook(ThreadVars *th_v, const DetectEngineCtx *de_ctx,
223  DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
224  enum DetectFirewallPacketPolicies fw_pkt_policy)
225 {
226  SCEnter();
227  SCLogDebug("pcap_cnt %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
228  p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
229  : "noflow",
230  PktSrcToString(p->pkt_src));
231 
232  /* Load the Packet's flow early, even though it might not be needed.
233  * Mark as a constant pointer, although the flow itself can change. */
234  Flow *const pflow = p->flow;
235 
236  DetectRunScratchpad scratch = DetectRunSetup(de_ctx, det_ctx, p, pflow, fw_pkt_policy);
237  scratch.sgh = sgh;
238 
239  /* if we didn't get a sig group head, we
240  * have nothing to do.... */
241  if (scratch.sgh == NULL) {
242  SCLogDebug("no sgh for this packet, nothing to match against");
243  goto end;
244  }
245 
246  /* run the prefilters for packets */
247  DetectRunPrefilterPkt(th_v, de_ctx, det_ctx, p, &scratch);
248 
249  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES); // TODO
250  /* inspect the rules against the packet */
251  const uint8_t pkt_policy = DetectRulePacketRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
252  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
253  if (pkt_policy & (ACTION_DROP | ACTION_ACCEPT)) {
254  goto end;
255  }
256 
257 end:
258  DetectRunPostRules(th_v, de_ctx, det_ctx, p, pflow, &scratch);
259 
260  DetectRunCleanup(det_ctx, p, pflow);
261  SCReturn;
262 }
263 
264 static void DetectRunPostMatch(ThreadVars *tv,
265  DetectEngineThreadCtx *det_ctx, Packet *p,
266  const Signature *s)
267 {
268  /* run the packet match functions */
269  const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_POSTMATCH];
270  if (smd != NULL) {
271  KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_POSTMATCH);
272 
273  SCLogDebug("running match functions, sm %p", smd);
274 
275  while (1) {
276  KEYWORD_PROFILING_START;
277  (void)sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx);
278  KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
279  if (smd->is_last)
280  break;
281  smd++;
282  }
283  }
284 }
285 
286 /**
287  * \brief Get the SigGroupHead for a packet.
288  *
289  * \param de_ctx detection engine context
290  * \param p packet
291  *
292  * \retval sgh the SigGroupHead or NULL if non applies to the packet
293  */
294 const SigGroupHead *SigMatchSignaturesGetSgh(const DetectEngineCtx *de_ctx,
295  const Packet *p)
296 {
297  SCEnter();
298  SigGroupHead *sgh = NULL;
299 
300  /* use ethernet non-IP sgh if we're ethernet but have no (valid) IP layer on top of it. */
301  if (PacketIsEthernet(p) && p->proto == 0 && de_ctx->eth_non_ip_sgh != NULL) {
302  SCLogDebug("using eth_non_ip_sgh %p", de_ctx->eth_non_ip_sgh);
303  SCReturnPtr(de_ctx->eth_non_ip_sgh, "SigGroupHead");
304  }
305 
306  /* if the packet proto is 0 (not set), we're inspecting it against
307  * the decoder events sgh we have. */
308  if (p->proto == 0 && p->events.cnt > 0) {
309  SCReturnPtr(de_ctx->decoder_event_sgh, "SigGroupHead");
310  } else if (p->proto == 0) {
311  if (!(PacketIsIPv4(p) || PacketIsIPv6(p))) {
312  /* not IP, so nothing to do */
313  SCReturnPtr(NULL, "SigGroupHead");
314  }
315  }
316 
317  /* select the flow_gh */
318  const int dir = (p->flowflags & FLOW_PKT_TOCLIENT) == 0;
319 
320  int proto = PacketGetIPProto(p);
321  if (proto == IPPROTO_TCP) {
322  DetectPort *list = de_ctx->flow_gh[dir].tcp;
323  SCLogDebug("tcp toserver %p, tcp toclient %p: going to use %p", de_ctx->flow_gh[1].tcp,
324  de_ctx->flow_gh[0].tcp, de_ctx->flow_gh[dir].tcp);
325  const uint16_t port = dir ? p->dp : p->sp;
326  SCLogDebug("tcp port %u -> %u:%u", port, p->sp, p->dp);
327  DetectPort *sghport = DetectPortLookupGroup(list, port);
328  if (sghport != NULL)
329  sgh = sghport->sh;
330  SCLogDebug("TCP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
331  dir ? "toserver" : "toclient", sghport, sgh);
332  } else if (proto == IPPROTO_UDP) {
333  DetectPort *list = de_ctx->flow_gh[dir].udp;
334  uint16_t port = dir ? p->dp : p->sp;
335  DetectPort *sghport = DetectPortLookupGroup(list, port);
336  if (sghport != NULL)
337  sgh = sghport->sh;
338  SCLogDebug("UDP list %p, port %u, direction %s, sghport %p, sgh %p", list, port,
339  dir ? "toserver" : "toclient", sghport, sgh);
340  } else {
341  sgh = de_ctx->flow_gh[dir].sgh[proto];
342  }
343 
344  SCReturnPtr(sgh, "SigGroupHead");
345 }
346 
347 static inline void DetectPrefilterCopyDeDup(
348  const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx)
349 {
350  SigIntId *pf_ptr = det_ctx->pmq.rule_id_array;
351  uint32_t final_cnt = det_ctx->pmq.rule_id_array_cnt;
352  Signature **sig_array = de_ctx->sig_array;
353  Signature **match_array = det_ctx->match_array;
354  SigIntId previous_id = (SigIntId)-1;
355  while (final_cnt-- > 0) {
356  SigIntId id = *pf_ptr++;
357  Signature *s = sig_array[id];
358 
359  /* As the prefilter list can contain duplicates, check for that here. */
360  if (likely(id != previous_id)) {
361  *match_array++ = s;
362  previous_id = id;
363  }
364  }
365 
366  det_ctx->match_array_cnt = (uint32_t)(match_array - det_ctx->match_array);
367  DEBUG_VALIDATE_BUG_ON(det_ctx->pmq.rule_id_array_cnt < det_ctx->match_array_cnt);
368  PMQ_RESET(&det_ctx->pmq);
369 }
370 
371 /** \internal
372  * \brief update flow's file tracking flags based on the detection engine
373  * A set of flags is prepared that is sent to the File API. The
374  File API may reject one or more based on the global force settings.
375  */
376 static inline void
377 DetectPostInspectFileFlagsUpdate(Flow *f, const SigGroupHead *sgh, uint8_t direction)
378 {
379  uint16_t flow_file_flags = FLOWFILE_INIT;
380 
381  if (sgh == NULL) {
382  SCLogDebug("requesting disabling all file features for flow");
383  flow_file_flags = FLOWFILE_NONE;
384  } else {
385  if (sgh->filestore_cnt == 0) {
386  SCLogDebug("requesting disabling filestore for flow");
387  flow_file_flags |= (FLOWFILE_NO_STORE_TS|FLOWFILE_NO_STORE_TC);
388  }
389 #ifdef HAVE_MAGIC
390  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)) {
391  SCLogDebug("requesting disabling magic for flow");
392  flow_file_flags |= (FLOWFILE_NO_MAGIC_TS|FLOWFILE_NO_MAGIC_TC);
393  }
394 #endif
395  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMD5)) {
396  SCLogDebug("requesting disabling md5 for flow");
397  flow_file_flags |= (FLOWFILE_NO_MD5_TS|FLOWFILE_NO_MD5_TC);
398  }
399  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA1)) {
400  SCLogDebug("requesting disabling sha1 for flow");
401  flow_file_flags |= (FLOWFILE_NO_SHA1_TS|FLOWFILE_NO_SHA1_TC);
402  }
403  if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA256)) {
404  SCLogDebug("requesting disabling sha256 for flow");
405  flow_file_flags |= (FLOWFILE_NO_SHA256_TS|FLOWFILE_NO_SHA256_TC);
406  }
407  }
408  if (flow_file_flags != 0) {
409  FileUpdateFlowFileFlags(f, flow_file_flags, direction);
410  }
411 }
412 
413 static inline void
414 DetectRunPostGetFirstRuleGroup(const Packet *p, Flow *pflow, const SigGroupHead *sgh)
415 {
416  if ((p->flowflags & FLOW_PKT_TOSERVER) && !(pflow->flags & FLOW_SGH_TOSERVER)) {
417  /* first time we see this toserver sgh, store it */
418  pflow->sgh_toserver = sgh;
419  pflow->flags |= FLOW_SGH_TOSERVER;
420 
421  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
422  if (pflow->protoctx != NULL) {
423  TcpSession *ssn = pflow->protoctx;
424  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.client");
425  ssn->client.flags |= STREAMTCP_STREAM_FLAG_DISABLE_RAW;
426  }
427  }
428 
429  DetectPostInspectFileFlagsUpdate(pflow,
430  pflow->sgh_toserver, STREAM_TOSERVER);
431 
432  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && !(pflow->flags & FLOW_SGH_TOCLIENT)) {
433  pflow->sgh_toclient = sgh;
434  pflow->flags |= FLOW_SGH_TOCLIENT;
435 
436  if (p->proto == IPPROTO_TCP && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVERAWSTREAM))) {
437  if (pflow->protoctx != NULL) {
438  TcpSession *ssn = pflow->protoctx;
439  SCLogDebug("STREAMTCP_STREAM_FLAG_DISABLE_RAW ssn.server");
440  ssn->server.flags |= STREAMTCP_STREAM_FLAG_DISABLE_RAW;
441  }
442  }
443 
444  DetectPostInspectFileFlagsUpdate(pflow,
445  pflow->sgh_toclient, STREAM_TOCLIENT);
446  }
447 }
448 
449 static inline void DetectRunGetRuleGroup(
450  const DetectEngineCtx *de_ctx,
451  Packet * const p, Flow * const pflow,
452  DetectRunScratchpad *scratch)
453 {
454  const SigGroupHead *sgh = NULL;
455 
456  if (pflow) {
457  bool use_flow_sgh = false;
458  /* Get the stored sgh from the flow (if any). Make sure we're not using
459  * the sgh for icmp error packets part of the same stream. */
460  if (PacketGetIPProto(p) == pflow->proto) { /* filter out icmp */
461  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
462  if ((p->flowflags & FLOW_PKT_TOSERVER) && (pflow->flags & FLOW_SGH_TOSERVER)) {
463  sgh = pflow->sgh_toserver;
464  SCLogDebug("sgh = pflow->sgh_toserver; => %p", sgh);
465  use_flow_sgh = true;
466  } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && (pflow->flags & FLOW_SGH_TOCLIENT)) {
467  sgh = pflow->sgh_toclient;
468  SCLogDebug("sgh = pflow->sgh_toclient; => %p", sgh);
469  use_flow_sgh = true;
470  }
471  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
472  }
473 
474  if (!(use_flow_sgh)) {
475  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
476  sgh = SigMatchSignaturesGetSgh(de_ctx, p);
477  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
478 
479  /* HACK: prevent the wrong sgh (or NULL) from being stored in the
480  * flow's sgh pointers */
481  if (PacketIsICMPv4(p) && ICMPV4_DEST_UNREACH_IS_VALID(p)) {
482  ; /* no-op */
483  } else {
484  /* store the found sgh (or NULL) in the flow to save us
485  * from looking it up again for the next packet.
486  * Also run other tasks */
487  DetectRunPostGetFirstRuleGroup(p, pflow, sgh);
488  }
489  }
490  } else { /* p->flags & PKT_HAS_FLOW */
491  /* no flow */
492 
493  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH);
494  sgh = SigMatchSignaturesGetSgh(de_ctx, p);
495  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
496  }
497 
498  scratch->sgh = sgh;
499 }
500 
501 static void DetectRunInspectIPOnly(ThreadVars *tv, const DetectEngineCtx *de_ctx,
502  DetectEngineThreadCtx *det_ctx,
503  Flow * const pflow, Packet * const p)
504 {
505  if (pflow) {
506  if (p->flowflags & (FLOW_PKT_TOSERVER_FIRST | FLOW_PKT_TOCLIENT_FIRST)) {
507  SCLogDebug("testing against \"ip-only\" signatures");
508 
509  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
510  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
511  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
512  }
513  } else { /* p->flags & PKT_HAS_FLOW */
514  /* no flow */
515 
516  /* Even without flow we should match the packet src/dst */
517  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY);
518  IPOnlyMatchPacket(tv, de_ctx, det_ctx, &de_ctx->io_ctx, p);
519  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY);
520  }
521 }
522 
523 /** \internal
524  * \brief inspect the rule header: protocol, ports, etc
525  * \retval bool false if no match, true if match */
526 static inline bool DetectRunInspectRuleHeader(
527  const Packet *p, const Flow *f, const Signature *s, const uint32_t sflags)
528 {
529  /* check if this signature has a requirement for flowvars of some type
530  * and if so, if we actually have any in the flow. If not, the sig
531  * can't match and we skip it. */
532  if ((p->flags & PKT_HAS_FLOW) && (sflags & SIG_FLAG_REQUIRE_FLOWVAR)) {
533  DEBUG_VALIDATE_BUG_ON(f == NULL);
534 
535  /* no flowvars? skip this sig */
536  const bool fv = f->flowvar != NULL;
537  if (!fv) {
538  SCLogDebug("skipping sig as the flow has no flowvars and sig "
539  "has SIG_FLAG_REQUIRE_FLOWVAR flag set.");
540  return false;
541  }
542  }
543 
544  if (!(s->proto == NULL)) {
545  const uint8_t s_proto_flags = s->proto->flags;
546  /* TODO does it make sense to move these flags to s->flags? */
547  if ((s_proto_flags & DETECT_PROTO_IPV4) && !PacketIsIPv4(p)) {
548  SCLogDebug("ip version didn't match");
549  return false;
550  }
551  if ((s_proto_flags & DETECT_PROTO_IPV6) && !PacketIsIPv6(p)) {
552  SCLogDebug("ip version didn't match");
553  return false;
554  }
555  if (DetectProtoContainsProto(s->proto, PacketGetIPProto(p)) == 0) {
556  SCLogDebug("proto didn't match");
557  if (PacketIsEthernet(p) &&
558  (s_proto_flags & (DETECT_PROTO_ETHERNET | DETECT_PROTO_ARP))) {
559  SCLogDebug("checking ether/arp protocol");
560  if ((s_proto_flags & DETECT_PROTO_ARP) && !PacketIsARP(p)) {
561  return false;
562  }
563  SCLogDebug("checking eth protocol: match!");
564  } else {
565  return false;
566  }
567  }
568  }
569 
570  /* check the source & dst port in the sig */
571  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) {
572  if (!(sflags & SIG_FLAG_DP_ANY)) {
573  if (p->flags & PKT_IS_FRAGMENT)
574  return false;
575  const DetectPort *dport = DetectPortLookupGroup(s->dp, p->dp);
576  if (dport == NULL) {
577  SCLogDebug("dport didn't match.");
578  return false;
579  }
580  }
581  if (!(sflags & SIG_FLAG_SP_ANY)) {
582  if (p->flags & PKT_IS_FRAGMENT)
583  return false;
584  const DetectPort *sport = DetectPortLookupGroup(s->sp, p->sp);
585  if (sport == NULL) {
586  SCLogDebug("sport didn't match.");
587  return false;
588  }
589  }
590  } else if ((sflags & (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) != (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) {
591  SCLogDebug("port-less protocol and sig needs ports");
592  return false;
593  }
594 
595  /* check the destination address */
596  if (!(sflags & SIG_FLAG_DST_ANY)) {
597  if (PacketIsIPv4(p)) {
598  if (DetectAddressMatchIPv4(s->addr_dst_match4, s->addr_dst_match4_cnt, &p->dst) == 0)
599  return false;
600  } else if (PacketIsIPv6(p)) {
601  if (DetectAddressMatchIPv6(s->addr_dst_match6, s->addr_dst_match6_cnt, &p->dst) == 0)
602  return false;
603  }
604  }
605  /* check the source address */
606  if (!(sflags & SIG_FLAG_SRC_ANY)) {
607  if (PacketIsIPv4(p)) {
608  if (DetectAddressMatchIPv4(s->addr_src_match4, s->addr_src_match4_cnt, &p->src) == 0)
609  return false;
610  } else if (PacketIsIPv6(p)) {
611  if (DetectAddressMatchIPv6(s->addr_src_match6, s->addr_src_match6_cnt, &p->src) == 0)
612  return false;
613  }
614  }
615 
616  return true;
617 }
618 
619 /** \internal
620  * \brief run packet/stream prefilter engines
621  */
622 static inline void DetectRunPrefilterPkt(ThreadVars *tv, const DetectEngineCtx *de_ctx,
623  DetectEngineThreadCtx *det_ctx, Packet *p, DetectRunScratchpad *scratch)
624 {
625  /* create our prefilter mask */
626  PacketCreateMask(p, &p->sig_mask, scratch->alproto, scratch->app_decoder_events);
627  /* run the prefilter engines */
628  Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags, p->sig_mask);
629  /* create match list if we have non-pf and/or pf */
630  if (det_ctx->pmq.rule_id_array_cnt) {
631 #ifdef PROFILING
632  if (tv) {
633  StatsCounterAvgAddI64(
634  &tv->stats, det_ctx->counter_mpm_list, (int64_t)det_ctx->pmq.rule_id_array_cnt);
635  }
636 #endif
637  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
638  DetectPrefilterCopyDeDup(de_ctx, det_ctx);
639  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
640  }
641 }
642 
643 /** \internal
644  * \brief check if the tx whose id is given is the only one
645  * live transaction for the flow in the given direction
646  *
647  * \param f flow
648  * \param txid transaction id
649  * \param dir direction
650  *
651  * \retval bool true if we are sure this tx is the only one live in said direction
652  */
653 static bool IsOnlyTxInDirection(Flow *f, uint64_t txid, uint8_t dir)
654 {
655  uint64_t tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
656  if (tx_cnt == txid + 1) {
657  // only live tx
658  return true;
659  }
660  if (tx_cnt == txid + 2) {
661  // 2 live txs, one after us
662  void *tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, txid + 1);
663  if (tx) {
664  AppLayerTxData *txd = AppLayerParserGetTxData(f->proto, f->alproto, tx);
665  // test if the other tx is unidirectional in the other way
666  if ((dir == STREAM_TOSERVER && (txd->flags & APP_LAYER_TX_SKIP_INSPECT_TS)) ||
667  (dir == STREAM_TOCLIENT && (txd->flags & APP_LAYER_TX_SKIP_INSPECT_TC))) {
668  return true;
669  }
670  }
671  }
672  return false;
673 }
674 
675 static int SortHelper(const void *a, const void *b)
676 {
677  const Signature *sa = *(const Signature **)a;
678  const Signature *sb = *(const Signature **)b;
679  if (sa->iid == sb->iid)
680  return 0;
681  return sa->iid > sb->iid ? 1 : -1;
682 }
683 
684 static inline bool SkipFwRules(const Packet *p)
685 {
686  if (p->flow != NULL) {
687  return (p->flow->flags & FLOW_ACTION_ACCEPT) != 0;
688  }
689  return false;
690 }
691 
692 /**
693  * \internal
694  * \brief apply packet default policy
695  * \param[in] de_ctx detect engine, for looking up the policy
696  * \param[in] policy policy to apply
697  * \param[in] p packet to apply policy to
698  * \param[in] final see if we need to apply accept:hook to the packet
699  * \retval action action to immediately apply, accept:hook will not set this unless final is true
700  *
701  * If this is run from the post-match final check, we need to apply a
702  * packet:filter accept:hook to the packet as well.
703  */
704 static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
705  DetectEngineThreadCtx *det_ctx, const enum DetectFirewallPacketPolicies policy, Packet *p,
706  const bool final)
707 {
708  DEBUG_VALIDATE_BUG_ON(de_ctx->fw_policies == NULL);
709  const struct DetectFirewallPolicy *pol = &de_ctx->fw_policies->pkt[policy];
710  if (pol->action & ACTION_DROP) {
711  SCLogDebug("packet %" PRIu64 ": drop PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY",
712  PcapPacketCntGet(p));
713  PacketDrop(p, pol->action, PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY);
714  } else if (pol->action & ACTION_ACCEPT) {
715  SCLogDebug("packet %" PRIu64 ": accept", PcapPacketCntGet(p));
716  if (pol->action_scope == ACTION_SCOPE_PACKET) {
717  p->action |= pol->action;
718  SCLogDebug("packet %" PRIu64 ": accept scope packet", PcapPacketCntGet(p));
719  } else if (pol->action_scope == ACTION_SCOPE_HOOK) {
720  SCLogDebug("packet %" PRIu64 ": accept scope hook", PcapPacketCntGet(p));
721  if (final) {
722  p->action |= pol->action;
723  SCLogDebug("packet %" PRIu64 ": accept scope hook upgraded to packet",
724  PcapPacketCntGet(p));
725  }
726  } else if (pol->action_scope == ACTION_SCOPE_FLOW) {
727  p->action |= pol->action;
728  SCLogDebug("packet %" PRIu64 ": accept scope flow", PcapPacketCntGet(p));
729  if (p->flow) {
730  p->flow->flags |= FLOW_ACTION_ACCEPT;
731  }
732  } else {
733  /* should be unreachable */
734  DEBUG_VALIDATE_BUG_ON(1);
735  }
736  } else {
737  /* should be unreachable */
738  DEBUG_VALIDATE_BUG_ON(1);
739  }
740  Signature *s = de_ctx->fw_policies->pkt_policy_signatures[policy];
741  if (s != NULL) {
742  AlertQueueAppendPacket(det_ctx, s, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
743  }
744  return p->action;
745 }
746 
747 /** \internal
748  * \brief helper for appending a packet alert
749  * Tries to find (guess) a TX to add to the alert.
750  */
751 static void DetectRulePacketAppendAlert(const DetectEngineCtx *de_ctx,
752  DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, Flow *f,
753  const uint8_t alert_flags_in)
754 {
755  DEBUG_VALIDATE_BUG_ON(alert_flags_in & PACKET_ALERT_FLAG_TX);
756 
757  if (f && f->alstate) {
758  const uint8_t dir = (p->flowflags & FLOW_PKT_TOCLIENT) ? STREAM_TOCLIENT : STREAM_TOSERVER;
759  const uint64_t tx_id = AppLayerParserGetTransactionInspectId(f->alparser, dir);
760  if ((s->alproto != ALPROTO_UNKNOWN && f->proto == IPPROTO_UDP) ||
761  (de_ctx->guess_applayer && IsOnlyTxInDirection(f, tx_id, dir))) {
762  // if there is a UDP specific app-layer signature,
763  // or only one live transaction
764  // try to use the good tx for the packet direction
765  void *tx_ptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, tx_id);
766  AppLayerTxData *txd =
767  tx_ptr ? AppLayerParserGetTxData(f->proto, f->alproto, tx_ptr) : NULL;
768  if (txd && txd->guessed_applayer_logged < de_ctx->guess_applayer_log_limit) {
769  uint8_t alert_flags = alert_flags_in;
770  if (f->proto != IPPROTO_UDP) {
771  alert_flags |= PACKET_ALERT_FLAG_TX_GUESSED;
772  }
773  txd->guessed_applayer_logged++;
774  AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, txd->tx_type, alert_flags);
775  return;
776  }
777  }
778  }
779  AlertQueueAppendPacket(det_ctx, s, p, alert_flags_in);
780 }
781 
782 static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
783  const DetectEngineCtx *const de_ctx, DetectEngineThreadCtx *const det_ctx, Packet *const p,
784  Flow *const pflow, const DetectRunScratchpad *scratch)
785 {
786  uint8_t action = 0;
787  bool fw_verdict = false;
788  const bool have_fw_rules = EngineModeIsFirewall();
789  const Signature *next_s = NULL;
790 
791  /* inspect the sigs against the packet */
792  /* Prefetch the next signature. */
793  SigIntId match_cnt = det_ctx->match_array_cnt;
794 #ifdef PROFILING
795  if (tv) {
796  StatsCounterAvgAddI64(&tv->stats, det_ctx->counter_match_list, (int64_t)match_cnt);
797  }
798 #endif
799  Signature **match_array = det_ctx->match_array;
800 
801  SGH_PROFILING_RECORD(det_ctx, scratch->sgh);
802 #ifdef PROFILING
803  if (match_cnt >= de_ctx->profile_match_logging_threshold)
804  RulesDumpMatchArray(det_ctx, scratch->sgh, p);
805 #endif
806 
807  bool skip_fw = SkipFwRules(p);
808  uint32_t sflags, next_sflags = 0;
809  if (match_cnt) {
810  next_s = *match_array++;
811  next_sflags = next_s->flags;
812  }
813  while (match_cnt--) {
814  RULE_PROFILING_START(p);
815  bool break_out_of_packet_filter = false;
816  uint8_t alert_flags = 0;
817 #ifdef PROFILE_RULES
818  bool smatch = false; /* signature match */
819 #endif
820  const Signature *s = next_s;
821  sflags = next_sflags;
822  if (match_cnt) {
823  next_s = *match_array++;
824  next_sflags = next_s->flags;
825  }
826 
827  SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", PcapPacketCntGet(p),
828  s->id);
829 
830  /* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */
831  if (s->flags & SIG_FLAG_FIREWALL) {
832  if (skip_fw) {
833  SCLogDebug("skipping firewall rule %u", s->id);
834  goto next;
835  }
836  } else if (have_fw_rules) {
837  /* fw mode, we skip anything after the fw rules if:
838  * - flow pass is set
839  * - packet pass (e.g. exception policy) */
840  if (p->flags & PKT_NOPACKET_INSPECTION ||
841  (pflow != NULL && pflow->flags & (FLOW_ACTION_PASS))) {
842  SCLogDebug("skipping firewall rule %u", s->id);
843  break_out_of_packet_filter = true;
844  goto next;
845  }
846  }
847 
848  if (s->app_inspect != NULL) {
849  goto next; // handle sig in DetectRunTx
850  }
851  if (s->frame_inspect != NULL) {
852  goto next; // handle sig in DetectRunFrame
853  }
854 
855  /* skip pkt sigs for flow end packets */
856  if ((p->flags & PKT_PSEUDO_STREAM_END) != 0 && s->type == SIG_TYPE_PKT)
857  goto next;
858 
859  /* don't run mask check for stateful rules.
860  * There we depend on prefilter */
861  if ((s->mask & p->sig_mask) != s->mask) {
862  SCLogDebug("mask mismatch %x & %x != %x", s->mask, p->sig_mask, s->mask);
863  goto next;
864  }
865 
866  if (SigDsizePrefilter(p, s, sflags))
867  goto next;
868 
869  /* if the sig has alproto and the session as well they should match */
870  if (likely(sflags & SIG_FLAG_APPLAYER)) {
871  if (s->alproto != ALPROTO_UNKNOWN && !AppProtoEquals(s->alproto, scratch->alproto)) {
872  SCLogDebug("alproto mismatch");
873  goto next;
874  }
875  }
876 
877  if (DetectRunInspectRuleHeader(p, pflow, s, sflags) == false) {
878  goto next;
879  }
880 
881  if (!DetectEnginePktInspectionRun(tv, det_ctx, s, pflow, p, &alert_flags)) {
882  goto next;
883  }
884 
885 #ifdef PROFILE_RULES
886  smatch = true;
887 #endif
888  DetectRunPostMatch(tv, det_ctx, p, s);
889 
890  DetectRulePacketAppendAlert(de_ctx, det_ctx, s, p, pflow, alert_flags);
891 
892  if (det_ctx->post_rule_work_queue.len > 0) {
893  /* run post match prefilter engines on work queue */
894  PrefilterPostRuleMatch(det_ctx, scratch->sgh, p, pflow);
895 
896  if (det_ctx->pmq.rule_id_array_cnt > 0) {
897  /* undo "prefetch" */
898  match_array--;
899  SCLogDebug("sig_array_len %u det_ctx->pmq.rule_id_array_cnt %u",
900  de_ctx->sig_array_len, det_ctx->pmq.rule_id_array_cnt);
901  const Signature **r = det_ctx->replace;
902  for (uint32_t x = 0; x < match_cnt; x++) {
903  *r++ = match_array[x];
904  SCLogDebug("appended %u", match_array[x]->id);
905  }
906  /* append the prefilter results, then sort it */
907  for (uint32_t x = 0; x < det_ctx->pmq.rule_id_array_cnt; x++) {
908  SCLogDebug("adding iid %u", det_ctx->pmq.rule_id_array[x]);
909  Signature *ts = de_ctx->sig_array[det_ctx->pmq.rule_id_array[x]];
910  SCLogDebug("adding id %u", ts->id);
911  if (ts->app_inspect == NULL) {
912  *r++ = ts;
913  match_cnt++;
914  }
915  }
916  if (match_cnt > 1) {
917  qsort(det_ctx->replace, match_cnt, sizeof(Signature *), SortHelper);
918  }
919  /* rewrite match_array to include the new additions, and deduplicate
920  * while at it. */
921  Signature **m = match_array;
922  Signature *last_sig = NULL;
923  uint32_t skipped = 0;
924  for (uint32_t x = 0; x < match_cnt; x++) {
925  /* de-duplicate */
926  if (last_sig == *m) {
927  skipped++;
928  continue;
929  }
930  last_sig = *m;
931  *m++ = (Signature *)det_ctx->replace[x];
932  }
933  match_cnt -= skipped;
934  /* prefetch next */
935  next_s = *match_array++;
936  next_sflags = next_s->flags;
937  SCLogDebug("%u rules added", det_ctx->pmq.rule_id_array_cnt);
938  det_ctx->post_rule_work_queue.len = 0;
939  PMQ_RESET(&det_ctx->pmq);
940  }
941  }
942 
943  /* firewall logic in the packet:filter table:
944  * 1. firewall rules preceed the packet:td rules in the list
945  * 2. if no rule issues an accept, we drop
946  * 3. drop is immediate
947  * 4. accept:
948  * - hook: skip rest of fw rules, inspect packet:td rules
949  * - packet: immediate accept, no packet:td or app:* inspect
950  * - flow: as packet, but applied to all future packets in the
951  * flow as well
952  */
953  if (s->flags & SIG_FLAG_FIREWALL) {
954  if (s->action & (ACTION_ACCEPT)) {
955  fw_verdict = true;
956 
957  enum ActionScope as = s->action_scope;
958  if (as == ACTION_SCOPE_HOOK) {
959  /* accept:hook: jump to first TD. Implemented as:
960  * skip until the first TD rule.
961  * Don't update action as we're just continuing to the next hook. */
962  skip_fw = true;
963 
964  } else if (as == ACTION_SCOPE_PACKET) {
965  /* accept:packet: break loop, return accept */
966  action |= s->action;
967  skip_fw = true;
968 
969  } else if (as == ACTION_SCOPE_FLOW) {
970  /* accept:flow: break loop, return accept */
971  action |= s->action;
972  skip_fw = true;
973 
974  /* set immediately, as we're in hook "packet_filter" */
975  if (pflow) {
976  pflow->flags |= FLOW_ACTION_ACCEPT;
977  }
978  }
979  } else if (s->action & ACTION_DROP) {
980  /* apply a drop immediately here */
981  fw_verdict = true;
982  action |= s->action;
983  break_out_of_packet_filter = true;
984  }
985  }
986 next:
987  DetectVarProcessList(det_ctx, pflow, p);
988  DetectReplaceFree(det_ctx);
989  RULE_PROFILING_END(det_ctx, s, smatch, p);
990 
991  /* fw drop means we're done here */
992  if (break_out_of_packet_filter)
993  break;
994 
995  continue;
996  }
997 
998  /* if no rule told us to accept, and no rule explicitly dropped, we invoke the default drop
999  * policy
1000  */
1001  if (have_fw_rules) {
1002  if (skip_fw || fw_verdict) {
1003  /* apply fw action */
1004  p->action |= action;
1005  } else {
1006  DEBUG_VALIDATE_BUG_ON(action & ACTION_DROP);
1007  /* non-final call as we may have to consider app-layer still */
1008  action |= DetectRunApplyPacketPolicy(de_ctx, det_ctx, scratch->fw_pkt_policy, p, false);
1009  }
1010  }
1011  return action;
1012 }
1013 
1014 /** \internal
1015  * \param fw_pkt_policy policy to apply to packet rules
1016  */
1017 static DetectRunScratchpad DetectRunSetup(const DetectEngineCtx *de_ctx,
1018  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
1019  const enum DetectFirewallPacketPolicies fw_pkt_policy)
1020 {
1021  AppProto alproto = ALPROTO_UNKNOWN;
1022  uint8_t flow_flags = 0; /* flow/state flags */
1023  bool app_decoder_events = false;
1024 
1025  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_SETUP);
1026 
1027 #ifdef UNITTESTS
1028  if (RunmodeIsUnittests()) {
1029  p->alerts.cnt = 0;
1030  p->alerts.discarded = 0;
1031  p->alerts.suppressed = 0;
1032  }
1033 #endif
1034  det_ctx->filestore_cnt = 0;
1035  det_ctx->base64_decoded_len = 0;
1036  det_ctx->raw_stream_progress = 0;
1037  det_ctx->match_array_cnt = 0;
1038  det_ctx->json_content_len = 0;
1039 
1040  det_ctx->alert_queue_size = 0;
1041  p->alerts.drop.action = 0;
1042  p->alerts.firewall_discarded = 0;
1043 
1044 #ifdef DEBUG
1045  if (p->flags & PKT_STREAM_ADD) {
1046  det_ctx->pkt_stream_add_cnt++;
1047  }
1048 #endif
1049 
1050  /* grab the protocol state we will detect on */
1051  if (p->flags & PKT_HAS_FLOW) {
1052  DEBUG_VALIDATE_BUG_ON(pflow == NULL);
1053 
1054  if (p->flowflags & FLOW_PKT_TOSERVER) {
1055  flow_flags = STREAM_TOSERVER;
1056  SCLogDebug("flag STREAM_TOSERVER set");
1057  } else if (p->flowflags & FLOW_PKT_TOCLIENT) {
1058  flow_flags = STREAM_TOCLIENT;
1059  SCLogDebug("flag STREAM_TOCLIENT set");
1060  }
1061  SCLogDebug("p->flowflags 0x%02x", p->flowflags);
1062 
1063  if (p->flags & PKT_PSEUDO_STREAM_END) {
1064  flow_flags |= STREAM_EOF;
1065  SCLogDebug("STREAM_EOF set");
1066  }
1067 
1068  /* store tenant_id in the flow so that we can use it
1069  * for creating pseudo packets */
1070  if (p->tenant_id > 0 && pflow->tenant_id == 0) {
1071  pflow->tenant_id = p->tenant_id;
1072  }
1073 
1074  /* live ruleswap check for flow updates */
1075  if (pflow->de_ctx_version == 0) {
1076  /* first time this flow is inspected, set id */
1077  pflow->de_ctx_version = de_ctx->version;
1078  } else if (pflow->de_ctx_version != de_ctx->version) {
1079  /* first time we inspect flow with this de_ctx, reset */
1080  pflow->flags &= ~FLOW_SGH_TOSERVER;
1081  pflow->flags &= ~FLOW_SGH_TOCLIENT;
1082  pflow->sgh_toserver = NULL;
1083  pflow->sgh_toclient = NULL;
1084 
1085  pflow->de_ctx_version = de_ctx->version;
1086  SCGenericVarFree(pflow->flowvar);
1087  pflow->flowvar = NULL;
1088 
1089  DetectEngineStateResetTxs(pflow);
1090  }
1091 
1092  /* Retrieve the app layer state and protocol and the tcp reassembled
1093  * stream chunks. */
1094  if ((p->proto == IPPROTO_TCP && (p->flags & PKT_STREAM_EST)) ||
1095  (p->proto == IPPROTO_UDP) ||
1096  (p->proto == IPPROTO_SCTP && (p->flowflags & FLOW_PKT_ESTABLISHED)))
1097  {
1098  /* update flow flags with knowledge on disruptions */
1099  flow_flags = FlowGetDisruptionFlags(pflow, flow_flags);
1100  alproto = SCFlowGetAppProtocol(pflow);
1101  if (p->proto == IPPROTO_TCP && pflow->protoctx &&
1102  StreamReassembleRawHasDataReady(pflow->protoctx, p)) {
1103  p->flags |= PKT_DETECT_HAS_STREAMDATA;
1104  }
1105  SCLogDebug("alproto %u", alproto);
1106  } else {
1107  SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
1108  }
1109 
1110  app_decoder_events = AppLayerParserHasDecoderEvents(pflow->alparser);
1111  }
1112 
1113  DetectRunScratchpad pad = { alproto, flow_flags, app_decoder_events, fw_pkt_policy, NULL };
1114  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_SETUP);
1115  return pad;
1116 }
1117 
1118 static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_ctx,
1119  DetectEngineThreadCtx *det_ctx, Packet *const p, Flow *const pflow,
1120  DetectRunScratchpad *scratch)
1121 {
1122  /* so now let's iterate the alerts and remove the ones after a pass rule
1123  * matched (if any). This is done inside PacketAlertFinalize() */
1124  /* PR: installed "tag" keywords are handled after the threshold inspection */
1125 
1126  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_ALERT);
1127  PacketAlertFinalize(de_ctx, det_ctx, p);
1128  if (p->alerts.cnt > 0) {
1129  StatsCounterAddI64(&tv->stats, det_ctx->counter_alerts, (uint64_t)p->alerts.cnt);
1130  }
1131  if (p->alerts.discarded > 0) {
1132  StatsCounterAddI64(
1133  &tv->stats, det_ctx->counter_alerts_overflow, (uint64_t)p->alerts.discarded);
1134  }
1135  if (p->alerts.firewall_discarded > 0) {
1136  StatsCounterAddI64(&tv->stats, det_ctx->counter_firewall_discarded_alerts,
1137  (uint64_t)p->alerts.firewall_discarded);
1138  }
1139  if (p->alerts.suppressed > 0) {
1140  StatsCounterAddI64(
1141  &tv->stats, det_ctx->counter_alerts_suppressed, (uint64_t)p->alerts.suppressed);
1142  }
1143  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_ALERT);
1144 
1145  /* firewall: "fail" closed if we don't have an ACCEPT. This can happen
1146  * if there was no rule group. */
1147  // TODO review packet src types here
1148  if (EngineModeIsFirewall() && ((p->action & (ACTION_ACCEPT | ACTION_DROP)) == 0) &&
1149  p->pkt_src == PKT_SRC_WIRE) {
1150  SCLogDebug("packet %" PRIu64 ": default action as no verdict set %02x (pkt %s)",
1151  PcapPacketCntGet(p), p->action, PktSrcToString(p->pkt_src));
1152  (void)DetectRunApplyPacketPolicy(de_ctx, det_ctx, scratch->fw_pkt_policy, p, true);
1153  DEBUG_VALIDATE_BUG_ON((p->action & (ACTION_DROP | ACTION_ACCEPT)) == 0);
1154  }
1155 }
1156 
1157 static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
1158  Packet *p, Flow * const pflow)
1159 {
1160  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
1161  InspectionBufferClean(det_ctx);
1162 
1163  if (pflow != NULL) {
1164  /* update inspected tracker for raw reassembly */
1165  if (p->proto == IPPROTO_TCP && pflow->protoctx != NULL &&
1166  (p->flags & PKT_DETECT_HAS_STREAMDATA)) {
1167  StreamReassembleRawUpdateProgress(pflow->protoctx, p,
1168  det_ctx->raw_stream_progress);
1169  }
1170  }
1171  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP);
1172  SCReturn;
1173 }
1174 
1175 enum DetectTxFirewallFlowControl {
1176  DETECT_TX_FW_FC_OK = 0, /**< continue to next rule */
1177  DETECT_TX_FW_FC_SKIP = 1, /**< skip this rule, continue to next */
1178  DETECT_TX_FW_FC_BREAK = 2, /**< break rule loop */
1179 };
1180 
1181 void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
1182 {
1183  DEBUG_VALIDATE_BUG_ON(det_ctx->tx_candidates);
1184  det_ctx->tx_candidates = SCCalloc(size, sizeof(RuleMatchCandidateTx));
1185  if (det_ctx->tx_candidates == NULL) {
1186  FatalError("failed to allocate %" PRIu64 " bytes",
1187  (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
1188  }
1189  det_ctx->tx_candidates_size = size;
1190  SCLogDebug("array initialized to %u elements (%"PRIu64" bytes)",
1191  size, (uint64_t)(size * sizeof(RuleMatchCandidateTx)));
1192 }
1193 
1194 void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
1195 {
1196  SCFree(det_ctx->tx_candidates);
1197  det_ctx->tx_candidates_size = 0;
1198 }
1199 
1200 /* if size >= cur_space */
1201 static inline bool RuleMatchCandidateTxArrayHasSpace(const DetectEngineThreadCtx *det_ctx,
1202  const uint32_t need)
1203 {
1204  if (det_ctx->tx_candidates_size >= need)
1205  return 1;
1206  return 0;
1207 }
1208 
1209 /* realloc */
1210 static int RuleMatchCandidateTxArrayExpand(DetectEngineThreadCtx *det_ctx, const uint32_t needed)
1211 {
1212  const uint32_t old_size = det_ctx->tx_candidates_size;
1213  uint32_t new_size = needed;
1214  void *ptmp = SCRealloc(det_ctx->tx_candidates, (new_size * sizeof(RuleMatchCandidateTx)));
1215  if (ptmp == NULL) {
1216  FatalError("failed to expand to %" PRIu64 " bytes",
1217  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx)));
1218  // TODO can this be handled more gracefully?
1219  }
1220  det_ctx->tx_candidates = ptmp;
1221  det_ctx->tx_candidates_size = new_size;
1222  SCLogDebug("array expanded from %u to %u elements (%"PRIu64" bytes -> %"PRIu64" bytes)",
1223  old_size, new_size, (uint64_t)(old_size * sizeof(RuleMatchCandidateTx)),
1224  (uint64_t)(new_size * sizeof(RuleMatchCandidateTx))); (void)old_size;
1225  return 1;
1226 }
1227 
1228 /** \internal
1229  * \brief sort helper for sorting match candidates by id: ascending
1230  *
1231  * The id field is set from Signature::num, so we sort the candidates to match the signature
1232  * sort order (ascending), where candidates that have flags go first.
1233  */
1234 static int
1235 DetectRunTxSortHelper(const void *a, const void *b)
1236 {
1237  const RuleMatchCandidateTx *s0 = a;
1238  const RuleMatchCandidateTx *s1 = b;
1239  if (s1->id == s0->id) {
1240  if (s1->flags && !s0->flags)
1241  return 1;
1242  else if (!s1->flags && s0->flags)
1243  return -1;
1244  return 0;
1245  } else
1246  return s0->id > s1->id ? 1 : -1;
1247 }
1248 
1249 #if 0
1250 #define TRACE_SID_TXS(sid,txs,...) \
1251  do { \
1252  char _trace_buf[2048]; \
1253  snprintf(_trace_buf, sizeof(_trace_buf), __VA_ARGS__); \
1254  SCLogNotice("%p/%"PRIu64"/%u: %s", txs->tx_ptr, txs->tx_id, sid, _trace_buf); \
1255  } while(0)
1256 #else
1257 #define TRACE_SID_TXS(sid,txs,...)
1258 #endif
1259 
1260 /** \internal
1261  * \brief get correct transaction pointer
1262  *
1263  * Gets an encapsulated DNS transaction in the DOH2 case.
1264  *
1265  * Returns NULL is the TX is not to be inspected by this engine.
1266  */
1267 void *DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
1268 {
1269  SCLogDebug("pre: tx_ptr %p flow::alproto %s engine::alproto %s", tx_ptr,
1270  AppProtoToString(alproto), AppProtoToString(engine_alproto));
1271  if (unlikely(alproto == ALPROTO_DOH2)) {
1272  switch (engine_alproto) {
1273  case ALPROTO_DOH2:
1274  /* need to get the dns tx pointer */
1275  tx_ptr = SCDoH2GetDnsTx(tx_ptr, flow_flags);
1276  break;
1277  case ALPROTO_HTTP2:
1278  case ALPROTO_UNKNOWN:
1279  /* tx_ptr is untouched, so use outer (HTTP/2) layer */
1280  break;
1281  default:
1282  /* any other protocol is a mismatch with DOH2 */
1283  tx_ptr = NULL;
1284  break;
1285  }
1286  } else if (engine_alproto != alproto && engine_alproto != ALPROTO_UNKNOWN) {
1287  /* incompatible engine->alproto with flow alproto */
1288  tx_ptr = NULL;
1289  }
1290  return tx_ptr;
1291 }
1292 
1293 /** \internal
1294  * \brief inspect a rule against a transaction
1295  *
1296  * Inspect a rule. New detection or continued stateful
1297  * detection.
1298  *
1299  * \param stored_flags pointer to stored flags or NULL.
1300  * If stored_flags is set it means we're continuing
1301  * inspection from an earlier run.
1302  *
1303  * \retval 1 sig matched
1304  * \retval 0 partial incomplete match
1305  * \retval -1 failed to match
1306  */
1307 static int DetectRunTxInspectRule(ThreadVars *tv, DetectEngineCtx *de_ctx,
1308  DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f,
1309  const uint8_t in_flow_flags, // direction, EOF, etc
1310  void *alstate, DetectTransaction *tx, const Signature *s, uint32_t *stored_flags,
1311  RuleMatchCandidateTx *can, DetectRunScratchpad *scratch)
1312 {
1313  const uint8_t flow_flags = in_flow_flags;
1314  const int direction = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1315  uint32_t inspect_flags = stored_flags ? *stored_flags : 0;
1316  int total_matches = 0;
1317  uint16_t file_no_match = 0;
1318  bool mpm_before_progress = false; // is mpm engine before progress?
1319  bool mpm_in_progress = false; // is mpm engine in a buffer we will revisit?
1320 
1321  TRACE_SID_TXS(s->id, tx, "starting %s", direction ? "toclient" : "toserver");
1322 
1323  /* for a new inspection we inspect pkt header and packet matches */
1324  if (likely(stored_flags == NULL)) {
1325  TRACE_SID_TXS(s->id, tx, "first inspect, run packet matches");
1326  if (DetectRunInspectRuleHeader(p, f, s, s->flags) == false) {
1327  TRACE_SID_TXS(s->id, tx, "DetectRunInspectRuleHeader() no match");
1328  return -1;
1329  }
1330  if (!DetectEnginePktInspectionRun(tv, det_ctx, s, f, p, NULL)) {
1331  TRACE_SID_TXS(s->id, tx, "DetectEnginePktInspectionRun no match");
1332  return -1;
1333  }
1334  /* stream mpm and negated mpm sigs can end up here with wrong proto */
1335  if (!(AppProtoEquals(s->alproto, f->alproto) || s->alproto == ALPROTO_UNKNOWN)) {
1336  TRACE_SID_TXS(s->id, tx, "alproto mismatch");
1337  return -1;
1338  }
1339  } else {
1340  TRACE_SID_TXS(s->id, tx, "continue, inspect_flags %x", inspect_flags);
1341  }
1342 
1343  const DetectEngineAppInspectionEngine *engine = s->app_inspect;
1344  do {
1345  TRACE_SID_TXS(s->id, tx, "engine %p inspect_flags %x", engine, inspect_flags);
1346 
1347  // also if it is not the same direction, but
1348  // this is a transactional signature, and we are toclient
1349  if (!(inspect_flags & BIT_U32(engine->id)) &&
1350  (direction == engine->dir || ((s->flags & SIG_FLAG_TXBOTHDIR) && direction == 1))) {
1351 
1352  DEBUG_VALIDATE_BUG_ON(
1353  AppLayerParserSupportsSubStates(engine->alproto) && engine->sub_state == 0);
1354  DEBUG_VALIDATE_BUG_ON(
1355  !AppLayerParserSupportsSubStates(engine->alproto) && engine->sub_state != 0);
1356 
1357  if (engine->alproto != ALPROTO_UNKNOWN && // app-layer-events is registered for each
1358  // proto this way
1359  tx->tx_type != engine->sub_state) {
1360  TRACE_SID_TXS(s->id, tx,
1361  "skip because engine alproto %s sub_state %u != tx_type %u (engine "
1362  "progress %u)",
1363  AppProtoToString(engine->alproto), engine->sub_state, tx->tx_type,
1364  engine->progress);
1365  engine = engine->next;
1366  continue;
1367  }
1368  TRACE_SID_TXS(s->id, tx,
1369  "inspecting engine alproto %s sub_state %u == tx_type %u (engine progress %u)",
1370  AppProtoToString(engine->alproto), engine->sub_state, tx->tx_type,
1371  engine->progress);
1372 
1373  void *tx_ptr = DetectGetInnerTx(tx->tx_ptr, f->alproto, engine->alproto, flow_flags);
1374  if (tx_ptr == NULL) {
1375  TRACE_SID_TXS(s->id, tx, "no tx_ptr after DetectGetInnerTx");
1376  if (engine->alproto != ALPROTO_UNKNOWN) {
1377  TRACE_SID_TXS(s->id, tx, "no tx_ptr skip engine");
1378  /* special case: file_data on 'alert tcp' will have engines
1379  * in the list that are not for us. */
1380  engine = engine->next;
1381  continue;
1382  } else {
1383  tx_ptr = tx->tx_ptr;
1384  }
1385  }
1386  TRACE_SID_TXS(s->id, tx, "tx_ptr %p", tx_ptr);
1387 
1388  /* engines are sorted per progress, except that the one with
1389  * mpm/prefilter enabled is first */
1390  if (tx->tx_progress < engine->progress) {
1391  SCLogDebug("tx progress %d < engine progress %d",
1392  tx->tx_progress, engine->progress);
1393  break;
1394  }
1395  if (engine->mpm) {
1396  if (tx->tx_progress > engine->progress) {
1397  TRACE_SID_TXS(s->id, tx,
1398  "engine->mpm: t->tx_progress %u > engine->progress %u, so set "
1399  "mpm_before_progress",
1400  tx->tx_progress, engine->progress);
1401  mpm_before_progress = true;
1402  } else if (tx->tx_progress == engine->progress) {
1403  TRACE_SID_TXS(s->id, tx,
1404  "engine->mpm: t->tx_progress %u == engine->progress %u, so set "
1405  "mpm_in_progress",
1406  tx->tx_progress, engine->progress);
1407  if ((p->flags & PKT_PSEUDO_DETECTLOG_FLUSH) == 0) {
1408  mpm_in_progress = true;
1409  }
1410  }
1411  }
1412 
1413  uint8_t engine_flags = flow_flags;
1414  if (direction != engine->dir) {
1415  engine_flags = flow_flags ^ (STREAM_TOCLIENT | STREAM_TOSERVER);
1416  }
1417  /* run callback: but bypass stream callback if we can */
1418  uint8_t match;
1419  if (unlikely(engine->stream && can->stream_stored)) {
1420  match = can->stream_result;
1421  TRACE_SID_TXS(s->id, tx, "stream skipped, stored result %d used instead", match);
1422  } else if (engine->v2.Callback == NULL) {
1423  /* TODO is this the cleanest way to support a non-app sig on a app hook? */
1424 
1425  if (tx->tx_progress > engine->progress) {
1426  mpm_before_progress = true; // TODO needs a new name now
1427  }
1428 
1429  /* we don't have to store a "hook" match, also don't want to keep any state to make
1430  * sure the hook gets invoked again until tx progress progresses. */
1431  if ((s->flags & SIG_FLAG_FW_HOOK_LTE) == 0 && tx->tx_progress <= engine->progress) {
1432  return 1; // DETECT_ENGINE_INSPECT_SIG_MATCH;
1433  }
1434 
1435  /* if progress > engine progress, track state to avoid additional matches */
1436  match = DETECT_ENGINE_INSPECT_SIG_MATCH;
1437  } else {
1438  KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list);
1439  DEBUG_VALIDATE_BUG_ON(engine->v2.Callback == NULL);
1440  match = engine->v2.Callback(
1441  de_ctx, det_ctx, engine, s, f, engine_flags, alstate, tx_ptr, tx->tx_id);
1442  TRACE_SID_TXS(s->id, tx, "engine %p match %d", engine, match);
1443  if (engine->stream) {
1444  can->stream_stored = true;
1445  can->stream_result = match;
1446  TRACE_SID_TXS(s->id, tx, "stream ran, store result %d for next tx (if any)", match);
1447  }
1448  }
1449  if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) {
1450  inspect_flags |= BIT_U32(engine->id);
1451  engine = engine->next;
1452  total_matches++;
1453  continue;
1454  } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) {
1455  /* if the file engine matched, but indicated more
1456  * files are still in progress, we don't set inspect
1457  * flags as these would end inspection for this tx */
1458  engine = engine->next;
1459  total_matches++;
1460  continue;
1461  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) {
1462  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1463  inspect_flags |= BIT_U32(engine->id);
1464  } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES) {
1465  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1466  inspect_flags |= BIT_U32(engine->id);
1467  file_no_match = 1;
1468  }
1469  /* implied DETECT_ENGINE_INSPECT_SIG_NO_MATCH */
1470  if (engine->mpm && mpm_before_progress) {
1471  inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
1472  inspect_flags |= BIT_U32(engine->id);
1473  }
1474  break;
1475  } else if (!(inspect_flags & BIT_U32(engine->id)) && s->flags & SIG_FLAG_TXBOTHDIR &&
1476  direction != engine->dir) {
1477  TRACE_SID_TXS(s->id, tx, "handle bidir engine");
1478 
1479  // for transactional rules, the engines on the opposite direction
1480  // are ordered by progress on the different side
1481  // so we have a two mixed-up lists, and we skip the elements
1482  if (direction == 0 && engine->next == NULL) {
1483  // do not match yet on request only
1484  break;
1485  }
1486  engine = engine->next;
1487  continue;
1488  }
1489 
1490  engine = engine->next;
1491  } while (engine != NULL);
1492  TRACE_SID_TXS(s->id, tx, "inspect_flags %x, total_matches %u, engine %p",
1493  inspect_flags, total_matches, engine);
1494 
1495  bool full_match = false;
1496  if (engine == NULL && total_matches) {
1497  inspect_flags |= DE_STATE_FLAG_FULL_INSPECT;
1498  TRACE_SID_TXS(s->id, tx, "MATCH");
1499  full_match = true;
1500  }
1501 
1502  if (stored_flags) {
1503  *stored_flags = inspect_flags;
1504  TRACE_SID_TXS(s->id, tx, "continue inspect flags %08x", inspect_flags);
1505  } else {
1506  // store... or? If tx is done we might not want to come back to this tx
1507 
1508  // also... if mpmid tracking is enabled, we won't do a sig again for this tx...
1509  TRACE_SID_TXS(s->id, tx, "start inspect flags %08x", inspect_flags);
1510  if (inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) {
1511  if (file_no_match) {
1512  /* if we have a mismatch on a file sig, we need to keep state.
1513  * We may get another file on the same tx (for http and smtp
1514  * at least), so for a new file we need to re-eval the sig.
1515  * Thoughts / TODO:
1516  * - not for some protos that have 1 file per tx (e.g. nfs)
1517  * - maybe we only need this for file sigs that mix with
1518  * other matches? E.g. 'POST + filename', is different than
1519  * just 'filename'.
1520  */
1521  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1522  inspect_flags, flow_flags, file_no_match);
1523  }
1524  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) && mpm_before_progress) {
1525  TRACE_SID_TXS(s->id, tx, "no need to store match sig, "
1526  "mpm won't trigger for it anymore");
1527 
1528  if (inspect_flags & DE_STATE_FLAG_FILE_INSPECT) {
1529  TRACE_SID_TXS(s->id, tx, "except that for new files, "
1530  "we may have to revisit anyway");
1531  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1532  inspect_flags, flow_flags, file_no_match);
1533  }
1534  } else if ((inspect_flags & DE_STATE_FLAG_FULL_INSPECT) == 0 && mpm_in_progress) {
1535  TRACE_SID_TXS(s->id, tx, "no need to store no-match sig, "
1536  "mpm will revisit it");
1537  return -1; /* no match */
1538  } else if (inspect_flags != 0 || file_no_match != 0) {
1539  TRACE_SID_TXS(s->id, tx, "storing state: flags %08x", inspect_flags);
1540  DetectRunStoreStateTx(scratch->sgh, f, tx->tx_ptr, tx->tx_id, s,
1541  inspect_flags, flow_flags, file_no_match);
1542  } else {
1543  if (inspect_flags == 0) {
1544  TRACE_SID_TXS(s->id, tx, "no match: inspect_flags %08x", inspect_flags);
1545  return -1;
1546  }
1547  }
1548  }
1549  if (full_match) {
1550  return 1;
1551  /* can't be a partial match if we're at the end state */
1552  } else if ((inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) == 0 &&
1553  tx->tx_progress < tx->tx_end_state) {
1554  return 0;
1555  } else {
1556  return -1;
1557  }
1558 }
1559 
1560 #define NO_TX \
1561  { \
1562  NULL, 0, NULL, NULL, 0, 0, 0, 0, false, 0, \
1563  }
1564 
1565 /** \internal
1566  * \brief get a DetectTransaction object
1567  * \retval struct filled with relevant info or all nulls/0s
1568  */
1569 static DetectTransaction GetDetectTx(const uint8_t ipproto, const AppProto alproto,
1570  const uint64_t tx_id, void *tx_ptr, const int tx_end_state, const uint8_t flow_flags)
1571 {
1572  DEBUG_VALIDATE_BUG_ON(tx_end_state >= APP_LAYER_MAX_PROGRESS);
1573 
1574  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx_ptr);
1575  const uint8_t tx_progress =
1576  (uint8_t)AppLayerParserGetStateProgress(ipproto, alproto, tx_ptr, flow_flags);
1577  DEBUG_VALIDATE_BUG_ON(tx_progress >= APP_LAYER_MAX_PROGRESS);
1578 
1579  const uint8_t e_tx_end_state = txd->tx_type == 0 ? (uint8_t)tx_end_state
1580  : (flow_flags & STREAM_TOSERVER) ? txd->tx_type_eop_ts
1581  : txd->tx_type_eop_tc;
1582 
1583  bool updated = (flow_flags & STREAM_TOSERVER) ? txd->updated_ts : txd->updated_tc;
1584  if (!updated && tx_progress < e_tx_end_state && ((flow_flags & STREAM_EOF) == 0)) {
1585  DetectTransaction no_tx = NO_TX;
1586  return no_tx;
1587  }
1588  const uint8_t inspected_flag =
1589  (flow_flags & STREAM_TOSERVER) ? APP_LAYER_TX_INSPECTED_TS : APP_LAYER_TX_INSPECTED_TC;
1590  if (unlikely(txd->flags & inspected_flag)) {
1591  SCLogDebug("%" PRIu64 " tx already fully inspected for %s. Flags %02x", tx_id,
1592  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", txd->flags);
1593  DetectTransaction no_tx = NO_TX;
1594  return no_tx;
1595  }
1596  const uint8_t skip_flag = (flow_flags & STREAM_TOSERVER) ? APP_LAYER_TX_SKIP_INSPECT_TS
1597  : APP_LAYER_TX_SKIP_INSPECT_TC;
1598  if (unlikely(txd->flags & skip_flag)) {
1599  SCLogDebug("%" PRIu64 " tx should not be inspected in direction %s. Flags %02x", tx_id,
1600  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", txd->flags);
1601  DetectTransaction no_tx = NO_TX;
1602  return no_tx;
1603  }
1604 
1605  if (txd->tx_type != 0) {
1606  SCLogDebug("using tx_type %u", txd->tx_type);
1607  }
1608 
1609  const uint8_t detect_progress =
1610  (flow_flags & STREAM_TOSERVER) ? txd->detect_progress_ts : txd->detect_progress_tc;
1611 
1612  const int dir_int = (flow_flags & STREAM_TOSERVER) ? 0 : 1;
1613  DetectEngineState *tx_de_state = txd->de_state;
1614  DetectEngineStateDirection *tx_dir_state =
1615  tx_de_state ? &tx_de_state->dir_state[dir_int] : NULL;
1616  DetectTransaction tx = {
1617  .tx_ptr = tx_ptr,
1618  .tx_id = tx_id,
1619  .tx_data_ptr = (struct AppLayerTxData *)txd,
1620  .de_state = tx_dir_state,
1621  .detect_progress = detect_progress,
1622  .detect_progress_orig = detect_progress,
1623  .tx_progress = (uint8_t)tx_progress,
1624  .tx_end_state = e_tx_end_state,
1625  .is_last = false,
1626  .tx_type = txd->tx_type,
1627  };
1628  return tx;
1629 }
1630 
1631 static inline void StoreDetectProgress(
1632  DetectTransaction *tx, const uint8_t flow_flags, const uint8_t progress)
1633 {
1634  AppLayerTxData *txd = (AppLayerTxData *)tx->tx_data_ptr;
1635  if (flow_flags & STREAM_TOSERVER) {
1636  txd->detect_progress_ts = progress;
1637  } else {
1638  txd->detect_progress_tc = progress;
1639  }
1640 }
1641 
1642 // Merge 'state' rules from the regular prefilter
1643 // updates array_idx on the way
1644 static inline void RuleMatchCandidateMergeStateRules(
1645  DetectEngineThreadCtx *det_ctx, uint32_t *array_idx)
1646 {
1647  // Now, we will merge 2 sorted lists :
1648  // the one in det_ctx->tx_candidates
1649  // and the one in det_ctx->match_array
1650  // For match_array, we take only the relevant elements where s->app_inspect != NULL
1651 
1652  // Basically, we iterate at the same time over the 2 lists
1653  // comparing and taking an element from either.
1654 
1655  // Trick is to do so in place in det_ctx->tx_candidates,
1656  // so as to minimize the number of moves in det_ctx->tx_candidates.
1657  // For this, the algorithm traverses the lists in reverse order.
1658  // Otherwise, if the first element of match_array was to be put before
1659  // all tx_candidates, we would need to shift all tx_candidates
1660 
1661  // Retain the number of elements sorted in tx_candidates before merge
1662  uint32_t j = *array_idx;
1663  // First loop only counting the number of elements to add
1664  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
1665  const Signature *s = det_ctx->match_array[i];
1666  if (s->app_inspect != NULL) {
1667  (*array_idx)++;
1668  }
1669  }
1670  // Future number of elements in tx_candidates after merge
1671  uint32_t k = *array_idx;
1672 
1673  if (k == j) {
1674  // no new element from match_array to merge in tx_candidates
1675  return;
1676  }
1677 
1678  // variable i is for all elements of match_array (even not relevant ones)
1679  // variable j is for elements of tx_candidates before merge
1680  // variable k is for elements of tx_candidates after merge
1681  for (uint32_t i = det_ctx->match_array_cnt; i > 0;) {
1682  const Signature *s = det_ctx->match_array[i - 1];
1683  if (s->app_inspect == NULL) {
1684  // no relevant element, get the next one from match_array
1685  i--;
1686  continue;
1687  }
1688  // we have one element from match_array to merge in tx_candidates
1689  k--;
1690  if (j > 0) {
1691  // j > 0 means there is still at least one element in tx_candidates to merge
1692  const RuleMatchCandidateTx *s0 = &det_ctx->tx_candidates[j - 1];
1693  if (s->iid <= s0->id) {
1694  // get next element from previous tx_candidates
1695  j--;
1696  // take the element from tx_candidates before merge
1697  det_ctx->tx_candidates[k].s = det_ctx->tx_candidates[j].s;
1698  det_ctx->tx_candidates[k].id = det_ctx->tx_candidates[j].id;
1699  det_ctx->tx_candidates[k].flags = det_ctx->tx_candidates[j].flags;
1700  det_ctx->tx_candidates[k].stream_reset = det_ctx->tx_candidates[j].stream_reset;
1701  continue;
1702  }
1703  } // otherwise
1704  // get next element from match_array
1705  i--;
1706  // take the element from match_array
1707  det_ctx->tx_candidates[k].s = s;
1708  det_ctx->tx_candidates[k].id = s->iid;
1709  det_ctx->tx_candidates[k].flags = NULL;
1710  det_ctx->tx_candidates[k].stream_reset = 0;
1711  }
1712  // Even if k > 0 or j > 0, the loop is over. (Note that j == k now)
1713  // The remaining elements in tx_candidates up to k were already sorted
1714  // and come before any other element later in the list
1715 }
1716 
1717 struct DetectFirewallAppTxState {
1718  bool fw_skip_app_filter;
1719  bool skip_fw_hook;
1720  uint8_t skip_before_progress;
1721  bool fw_last_for_progress;
1722  bool fw_next_progress_missing;
1723  bool last_fw_rule; /**< processing the last fw rule, so we need to eval all hooks after it. */
1724 };
1725 
1726 static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p,
1727  const bool apply_to_packet, const DetectTransaction *tx,
1728  const struct DetectFirewallAppPolicy *ap)
1729 {
1730  if (EngineModeIsFirewall()) {
1731  const Signature *s = ap->alert_signature;
1732  BUG_ON(s == NULL);
1733  uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
1734  AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx->tx_id, tx->tx_type, alert_flags);
1735  }
1736 }
1737 
1738 /** \internal
1739  * \brief apply default policy
1740  * \param p packet to apply policy to
1741  * \param alproto app proto
1742  * \param progress hook / progress value to apply the policy to
1743  *
1744  * \note alproto and progress are unused right now, will be used
1745  * to look up configurable default policies later
1746  */
1747 static struct DetectFirewallPolicy DetectFirewallApplyDefaultAppPolicy(
1748  DetectEngineThreadCtx *det_ctx, const struct DetectFirewallPolicies *policies,
1749  const DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
1750  const uint8_t progress)
1751 {
1752  const uint8_t dir_flags = direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
1753 
1754  SCLogDebug("packet %" PRIu64 ": tx type %u", PcapPacketCntGet(p), tx->tx_type);
1755 
1756  const struct DetectFirewallPolicy drop_policy = { .action = ACTION_DROP,
1757  .action_scope = ACTION_SCOPE_FLOW };
1758  const struct DetectFirewallAppPolicy lookup = {
1759  .alproto = alproto, .sub_state = tx->tx_type, .progress = progress, .direction = dir_flags
1760  };
1761  const struct DetectFirewallPolicy *policy = NULL;
1762  const struct DetectFirewallAppPolicy *ap =
1763  HashTableLookup(policies->app_policies, (void *)&lookup, 0);
1764  /* table should be fully populated, so this should not be able to fail.
1765  * However as it continues to confuse tooling, at a fallback. */
1766  DEBUG_VALIDATE_BUG_ON(ap == NULL);
1767  if (likely(ap != NULL)) {
1768  policy = &ap->policy;
1769  } else {
1770  policy = &drop_policy;
1771  }
1772  if (policy->action & ACTION_DROP) {
1773  SCLogDebug("dropping packet PKT_DROP_REASON_FW_DEFAULT_APP_POLICY");
1774  PacketDrop(p, policy->action, PKT_DROP_REASON_FW_DEFAULT_APP_POLICY);
1775  if (policy->action_scope == ACTION_SCOPE_FLOW) {
1776  SCLogDebug("dropping flow");
1777  p->flow->flags |= FLOW_ACTION_DROP;
1778  p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
1779  }
1780  if (policy->action & ACTION_ALERT) {
1781  DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx, ap);
1782  }
1783  } else if (policy->action & ACTION_ACCEPT) {
1784  /* should the accept be applied to the packet?
1785  * ACTION_SCOPE_FLOW: yes
1786  * ACTION_SCOPE_TX: only if last_tx
1787  * ACTION_SCOPE_HOOK: only if last_tx and hook is highest available hook
1788  */
1789  const bool last_hook = progress == tx->tx_progress;
1790  bool apply_to_packet = false;
1791 
1792  switch (policy->action_scope) {
1793  case ACTION_SCOPE_FLOW:
1794  p->flow->flags |= FLOW_ACTION_ACCEPT;
1795  apply_to_packet = true;
1796  break;
1797  case ACTION_SCOPE_TX:
1798  tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT;
1799  apply_to_packet = tx->is_last;
1800  break;
1801  case ACTION_SCOPE_HOOK:
1802  apply_to_packet = tx->is_last && last_hook;
1803  break;
1804  default:
1805  /* should be unreachable */
1806  DEBUG_VALIDATE_BUG_ON(1);
1807  break;
1808  }
1809  SCLogDebug("packet %" PRIu64 " hook %u default policy ACCEPT, apply_to_packet:%s",
1810  PcapPacketCntGet(p), progress, BOOL2STR(apply_to_packet));
1811 
1812  if (policy->action & ACTION_ALERT) {
1813  SCLogDebug("policy alert, do the append");
1814  DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx, ap);
1815  } else if (apply_to_packet) {
1816  SCLogDebug("default accept: last_tx");
1817  DetectRunAppendDefaultAccept(det_ctx, p);
1818  }
1819  } else {
1820  /* should be unreachable */
1821  DEBUG_VALIDATE_BUG_ON(1);
1822  }
1823  return *policy;
1824 }
1825 
1826 /** \internal
1827  * \brief run default policies for hook(s)
1828  *
1829  * For a range of hooks look up the policy and apply it.
1830  *
1831  * \param is_last is this tx the last we have? Used to check if an action needs to be applied to
1832  * the packet.
1833  *
1834  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't be inspected
1835  * \retval DETECT_TX_FW_FC_SKIP skip current firewall rule
1836  * \retval DETECT_TX_FW_FC_OK no action needed
1837  */
1838 static enum DetectTxFirewallFlowControl DetectFirewallApplyDefaultPolicies(
1839  DetectEngineThreadCtx *det_ctx, const struct DetectFirewallPolicies *policies,
1840  DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
1841  const uint8_t start_hook, const uint8_t end_hook)
1842 {
1843  DEBUG_VALIDATE_BUG_ON(start_hook > end_hook);
1844 
1845  const bool need_verdict =
1846  tx->is_last && (end_hook == tx->tx_end_state || end_hook == tx->tx_progress);
1847  SCLogDebug("need_verdict:%s is_last:%s end_hook:%u tx->tx_end_state:%u tx->progress: %u",
1848  BOOL2STR(need_verdict), BOOL2STR(tx->is_last), end_hook, tx->tx_end_state,
1849  tx->tx_progress);
1850 
1851  for (uint8_t hook = start_hook; hook <= end_hook; hook++) {
1852  const bool apply_to_packet =
1853  tx->is_last && (hook == tx->tx_end_state || hook == tx->tx_progress);
1854 
1855  SCLogDebug("%" PRIu64 ": %s default policy for hook %u, apply_to_packet %s",
1856  PcapPacketCntGet(p), direction & STREAM_TOSERVER ? "toserver" : "toclient", hook,
1857  BOOL2STR(apply_to_packet));
1858 
1859  const struct DetectFirewallPolicy policy = DetectFirewallApplyDefaultAppPolicy(
1860  det_ctx, policies, tx, p, alproto, direction, hook);
1861  SCLogDebug("fw: hook:%u policy:%02x apply_to_packet:%s", hook, policy.action,
1862  BOOL2STR(apply_to_packet));
1863  if (policy.action & ACTION_DROP) {
1864  SCLogDebug("fw: action %02x", policy.action);
1865  return DETECT_TX_FW_FC_BREAK;
1866 
1867  } else if (policy.action & ACTION_ACCEPT) {
1868  SCLogDebug("fw: accept hook %u action %02x", hook, policy.action);
1869 
1870  /* accepting flow, so skip rest of the fw rules */
1871  if (policy.action_scope == ACTION_SCOPE_FLOW) {
1872  SCLogDebug("fw: accept flow");
1873  return DETECT_TX_FW_FC_SKIP;
1874 
1875  /* accepting flow, so skip rest of the fw rules for this tx */
1876  } else if (policy.action_scope == ACTION_SCOPE_TX) {
1877  return DETECT_TX_FW_FC_SKIP;
1878 
1879  } else if (policy.action_scope == ACTION_SCOPE_HOOK) {
1880  /* we're done */
1881  if (apply_to_packet) {
1882  return DETECT_TX_FW_FC_SKIP;
1883  }
1884  } else {
1885  DEBUG_VALIDATE_BUG_ON(1);
1886  }
1887  } else {
1888  DEBUG_VALIDATE_BUG_ON(1);
1889  }
1890  }
1891 
1892  /* if the tx progress is at end_hook state, it means the rule that called us cannot
1893  * match: it's app_progress_hook is not yet available. In this can we need to set
1894  * a default accept. This happens if we got only `accept:hook` policies. */
1895  if (need_verdict) {
1896  SCLogDebug("default accept: last tx and progress at end_hook %u", end_hook);
1897  DetectRunAppendDefaultAccept(det_ctx, p);
1898  /* break as we can't match the calling signature */
1899  return DETECT_TX_FW_FC_BREAK;
1900  }
1901 
1902  return DETECT_TX_FW_FC_OK;
1903 }
1904 
1905 /** \internal
1906  * \brief run pre-rule inspection firewall policy checks
1907  *
1908  * Check for:
1909  * - check if we're in accept:tx mode
1910  * - check for missing accept hooks
1911  * -
1912  *
1913  * \retval DETECT_TX_FW_FC_OK no action needed
1914  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't be inspected
1915  * \retval DETECT_TX_FW_FC_SKIP skip this rule
1916  */
1917 static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy(
1918  DetectEngineThreadCtx *det_ctx, Packet *p, DetectTransaction *tx, const uint8_t direction,
1919  const Signature *s, const uint32_t can_idx, struct DetectFirewallAppTxState *fw_state)
1920 {
1921  SCLogDebug("packet %" PRIu64 ": running pre-checks before sid %u", PcapPacketCntGet(p), s->id);
1922 
1923  /* enforce skip app filter. If a prior rule caused a fw_skip_app_filter set, we will skip
1924  * each fw rule from now. Non-FW rules will just be inspected. Non-FW need to hit this
1925  * path to help put into effect the FLOW_ACTION_ACCEPT/APP_LAYER_TX_ACCEPT and call
1926  * the default policy enforcement. */
1927  if (fw_state->fw_skip_app_filter) {
1928  if ((s->flags & SIG_FLAG_FIREWALL) != 0) {
1929  return DETECT_TX_FW_FC_SKIP;
1930  } else {
1931  return DETECT_TX_FW_FC_OK;
1932  }
1933  }
1934  if (p->flow->flags & FLOW_ACTION_ACCEPT) {
1935  fw_state->fw_skip_app_filter = true;
1936  SCLogDebug("default accept due to flow accept");
1937  DetectRunAppendDefaultAccept(det_ctx, p);
1938 
1939  if (s->flags & SIG_FLAG_FIREWALL) {
1940  return DETECT_TX_FW_FC_SKIP;
1941  }
1942  }
1943  /* skip fw rules if we're in accept:tx mode */
1944  if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) {
1945  /* append a blank accept:packet action for the APP_LAYER_TX_ACCEPT,
1946  * if this is the last tx */
1947  fw_state->fw_skip_app_filter = true;
1948  const bool accept_tx_applies_to_packet = tx->is_last;
1949  if (accept_tx_applies_to_packet) {
1950  SCLogDebug("accept:tx: should be applied to the packet");
1951  DetectRunAppendDefaultAccept(det_ctx, p);
1952  }
1953 
1954  if (s->flags & SIG_FLAG_FIREWALL) {
1955  SCLogDebug("APP_LAYER_TX_ACCEPT, so skip rule");
1956  return DETECT_TX_FW_FC_SKIP;
1957  }
1958 
1959  /* threat detect rules will be inspected */
1960  return DETECT_TX_FW_FC_OK;
1961  }
1962 
1963  /* handle missing rules case */
1964  if (s->flags & SIG_FLAG_FW_HOOK_LTE) {
1965  SCLogDebug("SIG_FLAG_FW_HOOK_LTE");
1966  return DETECT_TX_FW_FC_OK; // TODO check for other cases
1967  }
1968  /* if our first rule is beyond the starting state, we need to check if
1969  * there are rules missing for states in between. */
1970  if (s->app_progress_hook > tx->detect_progress_orig && can_idx == 0) {
1971  SCLogDebug("missing fw rules at list start: sid %u, progress %u (%u:%u)", s->id,
1972  s->app_progress_hook, tx->detect_progress, tx->detect_progress_orig);
1973  /* if this rule was after the state we expected meaning that there are
1974  * no rules for that state. Invoke the default policies. */
1975  enum DetectTxFirewallFlowControl r =
1976  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
1977  s->alproto, direction, tx->detect_progress_orig, s->app_progress_hook - 1);
1978  if (r != DETECT_TX_FW_FC_OK) {
1979  /* both SKIP and BREAK mean: no more fw rules to inspect.
1980  * SKIP applies to just this TX.
1981  * DROP applies to everything. */
1982  fw_state->fw_skip_app_filter = true;
1983  }
1984  return r;
1985  }
1986  return DETECT_TX_FW_FC_OK;
1987 }
1988 
1989 /**
1990  * \internal
1991  * \brief Check and update firewall rules state.
1992  *
1993  * \param fw_state pointer to flow control state
1994  *
1995  * \retval DETECT_TX_FW_FC_OK no action needed
1996  * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't inspected
1997  * \retval DETECT_TX_FW_FC_SKIP skip this rule
1998  */
1999 static enum DetectTxFirewallFlowControl DetectRunTxCheckRuleState(DetectEngineThreadCtx *det_ctx,
2000  Packet *p, Flow *f, DetectTransaction *tx, const Signature *s, const uint32_t can_idx,
2001  const uint32_t can_size, struct DetectFirewallAppTxState *fw_state)
2002 {
2003  if (s->flags & SIG_FLAG_FIREWALL) {
2004  /* check if the next sig is on the same progress hook. If not, we need to apply our
2005  * default policy in case the current sig doesn't apply one. If the next sig has a
2006  * progress beyond our progress + 1, it means the next progress has no rules and needs
2007  * the default policy applied. But only after we evaluate the current rule first, as
2008  * that may override it. */
2009 
2010  if (can_idx + 1 < can_size) {
2011  const Signature *next_s = det_ctx->tx_candidates[can_idx + 1].s;
2012  SCLogDebug(
2013  "peek: peeking at sid %u / progress %u", next_s->id, next_s->app_progress_hook);
2014  if (next_s->flags & SIG_FLAG_FIREWALL) {
2015  if (s->app_progress_hook != next_s->app_progress_hook) {
2016  SCLogDebug("peek: next sid progress %u != current progress %u, so current "
2017  "is last for progress",
2018  next_s->app_progress_hook, s->app_progress_hook);
2019  fw_state->fw_last_for_progress = true;
2020 
2021  if (next_s->app_progress_hook - s->app_progress_hook > 1) {
2022  SCLogDebug("peek: missing progress, so we'll drop that unless we get a "
2023  "sweeping accept first");
2024  fw_state->fw_next_progress_missing = true;
2025  }
2026  }
2027  } else {
2028  SCLogDebug("peek: next sid not a fw rule, so current is last for progress");
2029  fw_state->fw_last_for_progress = true;
2030  fw_state->last_fw_rule = true;
2031  }
2032  } else {
2033  SCLogDebug("peek: no peek beyond last rule");
2034  if (s->app_progress_hook < tx->tx_progress) {
2035  SCLogDebug("peek: there are no rules to allow the state after this rule");
2036  fw_state->fw_next_progress_missing = true;
2037  }
2038  fw_state->fw_last_for_progress = true;
2039  fw_state->last_fw_rule = true;
2040  }
2041 
2042  if (fw_state->skip_fw_hook == true) {
2043  if (s->app_progress_hook <= fw_state->skip_before_progress) {
2044  return DETECT_TX_FW_FC_SKIP;
2045  }
2046  fw_state->skip_fw_hook = false;
2047  }
2048  } else {
2049  /* fw mode, we skip anything after the fw rules if:
2050  * - flow pass is set
2051  * - packet pass (e.g. exception policy) */
2052  if (p->flags & PKT_NOPACKET_INSPECTION || (f->flags & (FLOW_ACTION_PASS))) {
2053  SCLogDebug("skipping firewall rule %u", s->id);
2054  return DETECT_TX_FW_FC_BREAK;
2055  }
2056  }
2057  return DETECT_TX_FW_FC_OK;
2058 }
2059 
2060 // TODO move into det_ctx?
2061 thread_local Signature default_accept;
2062 static void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet *p)
2063 {
2064  DEBUG_VALIDATE_BUG_ON(!EngineModeIsFirewall());
2065  SCLogDebug("packet %" PRIu64 ": appending default firewall accept", PcapPacketCntGet(p));
2066  memset(&default_accept, 0, sizeof(default_accept));
2067  default_accept.action = ACTION_ACCEPT;
2068  default_accept.action_scope = ACTION_SCOPE_PACKET;
2069  default_accept.iid = UINT32_MAX;
2070  default_accept.type = SIG_TYPE_PKT;
2071  default_accept.flags = SIG_FLAG_FIREWALL;
2072  default_accept.detect_table =
2073  DETECT_TABLE_APP_FILTER; // TODO review, hope this makes it last in sorting
2074  AlertQueueAppendPacket(det_ctx, &default_accept, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
2075 }
2076 
2077 /** \internal
2078  * \brief see if the accept rule needs to apply to the packet
2079  */
2080 static inline bool ApplyAcceptToPacket(const DetectTransaction *tx, const Signature *s)
2081 {
2082  if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
2083  return false;
2084  }
2085  if ((s->action & ACTION_ACCEPT) == 0) {
2086  return false;
2087  }
2088 
2089  /* for accept:tx we need:
2090  * - packet will only be accepted if this is set on the last tx
2091  */
2092  if (s->action_scope == ACTION_SCOPE_TX) {
2093  if (tx->is_last) {
2094  return true;
2095  }
2096  }
2097  /* for accept:hook we need a bit more checking:
2098  * - packet will only be accepted if this is set on the last tx
2099  * - the hook accepted should be the last progress available. */
2100  if (s->action_scope == ACTION_SCOPE_HOOK) {
2101  if (tx->is_last && (s->app_progress_hook == tx->tx_progress)) {
2102  return true;
2103  }
2104  }
2105  return false;
2106 }
2107 
2108 /** \internal
2109  * \brief apply an accept, but do check policies when needed
2110  *
2111  * Updates flow control where needed.
2112  *
2113  * */
2114 static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packet *p,
2115  const uint8_t direction, const Signature *s, DetectTransaction *tx,
2116  struct DetectFirewallAppTxState *fw_state)
2117 {
2118  const enum ActionScope as = s->action_scope;
2119  /* accept:hook: jump to first rule of next state.
2120  * Implemented as skip until the first rule of next state. */
2121  if (as == ACTION_SCOPE_HOOK) {
2122  fw_state->skip_fw_hook = true;
2123  fw_state->skip_before_progress = s->app_progress_hook;
2124 
2125  SCLogDebug("fw match sid:%u hook:%u", s->id, s->app_progress_hook);
2126  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2127  "skip_before_progress:%u fw_last_for_progress:%s fw_next_progress_missing:%s",
2128  BOOL2STR(fw_state->fw_skip_app_filter), BOOL2STR(fw_state->skip_fw_hook),
2129  fw_state->skip_before_progress, BOOL2STR(fw_state->fw_last_for_progress),
2130  BOOL2STR(fw_state->fw_next_progress_missing));
2131  /* if there is no fw rule for the next progress value,
2132  * we invoke the defaul policies for the remaining available hooks. */
2133  if (fw_state->fw_next_progress_missing) {
2134  const uint8_t last_hook = fw_state->last_fw_rule
2135  ? tx->tx_end_state
2136  : MIN(tx->tx_end_state, s->app_progress_hook + 1);
2137  enum DetectTxFirewallFlowControl r =
2138  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
2139  s->alproto, direction, s->app_progress_hook + 1, last_hook);
2140  if (r == DETECT_TX_FW_FC_BREAK) {
2141  fw_state->fw_skip_app_filter = true;
2142  return;
2143  }
2144  }
2145  } else if (as == ACTION_SCOPE_TX) {
2146  tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT;
2147  fw_state->skip_fw_hook = true;
2148  fw_state->skip_before_progress = tx->tx_end_state + 1; // skip all hooks
2149  SCLogDebug("accept:tx applied, skip_fw_hook, skip_before_progress %u",
2150  fw_state->skip_before_progress);
2151  } else if (as == ACTION_SCOPE_PACKET) {
2152  fw_state->fw_skip_app_filter = true;
2153  } else if (as == ACTION_SCOPE_FLOW) {
2154  SCLogDebug("sid %u: ACTION_ACCEPT with ACTION_SCOPE_FLOW", s->id);
2155  fw_state->fw_skip_app_filter = true;
2156  }
2157 }
2158 
2159 /**
2160  * \internal
2161  * \brief check if there are no (fw) rules, and apply the default policies if so
2162  *
2163  * \retval 3 policies handled, continue with inspection
2164  * \retval 2 continue with next tx
2165  * \retval 1 done with inspection
2166  * \retval 0 ok, continue as normal. No policies applied.
2167  */
2168 static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f,
2169  DetectTransaction *tx, const AppProto alproto, const uint8_t flow_flags, const int rule_cnt)
2170 {
2171  /* if there are no rules / rule candidates, handling invoking the default
2172  * policy. */
2173  if (rule_cnt == 0 || (det_ctx->tx_candidates[0].s->flags & SIG_FLAG_FIREWALL) == 0) {
2174  /* if there are no rules, make sure to handle accept:flow and accept:tx */
2175  if (rule_cnt == 0) {
2176  if (f->flags & FLOW_ACTION_ACCEPT) {
2177  SCLogDebug("default accept:flow: no rules");
2178  DetectRunAppendDefaultAccept(det_ctx, p);
2179  return 1;
2180  }
2181  if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) {
2182  /* current tx is the last we have, append a blank accept:packet */
2183  if (tx->is_last) {
2184  SCLogDebug("default accept:tx: no rules");
2185  DetectRunAppendDefaultAccept(det_ctx, p);
2186  return 1;
2187  }
2188  return 2;
2189  }
2190  }
2191 
2192  /* if there are no fw rules, handle default policies */
2193  if ((f->flags & FLOW_ACTION_ACCEPT) == 0 &&
2194  (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) == 0) {
2195  /* No rules to eval, so we need to see if there are default policies to apply.
2196  * Start at last inspected progress and check each hook. If all hooks accepted,
2197  * apply the accept to the packet. */
2198  SCLogDebug("tx.detect_progress_orig %u tx.tx_progress %u", tx->detect_progress_orig,
2199  tx->tx_progress);
2200  enum DetectTxFirewallFlowControl r =
2201  DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies, tx, p,
2202  alproto, flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT),
2203  tx->detect_progress_orig, tx->tx_progress);
2204  SCLogDebug("r %u", r);
2205  if (r == DETECT_TX_FW_FC_BREAK)
2206  return 1;
2207  if (r == DETECT_TX_FW_FC_SKIP)
2208  return 2;
2209  /* continue with TD rules */
2210  SCLogDebug("continue with TD rules");
2211  return 3;
2212  }
2213  }
2214  return 0;
2215 }
2216 
2217 /** \internal
2218  * \brief handle a full rule match for a firewall rule
2219  *
2220  * For a drop/reject rule, excute action immediately.
2221  * For an accept rule, add an alert even to the queue. This will
2222  * allow TD rules to override the accept.
2223  */
2224 static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
2225  DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p,
2226  const uint8_t flow_flags)
2227 {
2228  if (s->action & ACTION_ACCEPT) {
2229  /* add alert now, as ApplyAccept may also trigger
2230  * policy matches that could add alerts. */
2231  SCLogDebug("append alert");
2232  /* see if we need to apply tx/hook accept to the packet. This can be needed
2233  * when we've completed the inspection so far for an incomplete tx, and an
2234  * accept:tx or accept:hook is the last match.*/
2235  const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
2236  if (fw_accept_to_packet) {
2237  SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
2238  SCLogDebug("accept:(tx|hook): should be applied to the packet");
2239  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type,
2240  PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
2241  } else {
2242  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2243  }
2244  DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
2245  } else if (s->action & ACTION_DROP) {
2246  SCLogDebug("drop packet because of rule with drop action");
2247  PacketDrop(p, s->action, PKT_DROP_REASON_FW_RULES);
2248  if (s->action_scope == ACTION_SCOPE_FLOW) {
2249  SCLogDebug("drop flow because of rule with drop action");
2250  f->flags |= FLOW_ACTION_DROP;
2251  f->flags |= FLOW_ACTION_BY_FIREWALL;
2252  }
2253  SCLogDebug("append alert");
2254  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2255  } else {
2256  SCLogDebug("append alert");
2257  AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
2258  }
2259 }
2260 
2261 /** \internal
2262  * \brief handle a partial match for firewall rules
2263  *
2264  * Currently only used for LTE mode. Regardless of the final action,
2265  * the partial match acts as a `accept:hook`.
2266  *
2267  * A default accept is appended. TD has a chance to override this accept.
2268  *
2269  * \retval 1 accept partial, caller must break loop
2270  * \retval 0 ok, caller must continue as normal
2271  */
2272 static int DetectRunTxFirewallRulePartialMatch(
2273  DetectEngineThreadCtx *det_ctx, const Signature *s, const DetectTransaction *tx, Packet *p)
2274 {
2275  if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT)) {
2276  /* partial match always uses ACTION_SCOPE_HOOK. Final action only on the full
2277  * match */
2278  if (tx->is_last) {
2279  SCLogDebug("need to apply accept to packet");
2280  DetectRunAppendDefaultAccept(det_ctx, p);
2281  }
2282  if (s->action_scope == ACTION_SCOPE_FLOW) {
2283  SCLogDebug("only applying accept:flow on full match, downgrading to "
2284  "accept:hook");
2285  }
2286  return 1;
2287  }
2288  return 0;
2289 }
2290 
2291 /** \internal
2292  * \brief handle the no-match case for a firewall rule
2293  *
2294  * If the rule did not match we need to see if we need invoke the default
2295  * policy for this hook. If that is the case, we handle a drop by telling the
2296  * caller about it. Flow control for various accept options is handled by the
2297  * next rule.
2298  *
2299  * \retval 1 dropped by policy, caller must return
2300  * \retval 0 ok, caller must continue as normal
2301  */
2302 static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
2303  DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Packet *p,
2304  const uint8_t flow_flags)
2305 {
2306  if (fw_state->fw_last_for_progress && (s->flags & SIG_FLAG_FIREWALL)) {
2307  SCLogDebug("%" PRIu64 ": %s default policy for progress %u", PcapPacketCntGet(p),
2308  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", s->app_progress_hook);
2309  /* if this rule was the last for our progress state, and it didn't match,
2310  * we have to invoke the default policy. We only check the current rule hook.
2311  * DROP is immediate, flow control for various accept options is handled by
2312  * the DetectRunTxPreCheckFirewallPolicy function for the next rule. */
2313  const struct DetectFirewallPolicy policy = DetectFirewallApplyDefaultAppPolicy(det_ctx,
2314  det_ctx->de_ctx->fw_policies, tx, p, s->alproto, flow_flags, s->app_progress_hook);
2315  SCLogDebug("fw_last_for_progress policy %02x", policy.action);
2316  if (policy.action & ACTION_DROP) {
2317  return 1;
2318  }
2319  }
2320  return 0;
2321 }
2322 
2323 /** \internal
2324  * \brief handle full match on rule when state didn't progress yet
2325  *
2326  * For a full rule match on a certain hook, we need to continue to enforce the
2327  * match as long as the tx progress doesn't move beyond that hook.
2328  */
2329 static void DetectRunTxFirewallRuleStatefulReApplyMatch(DetectEngineThreadCtx *det_ctx,
2330  const Signature *s, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state,
2331  Packet *p, const uint8_t flow_flags)
2332 {
2333  /* if we're still in the same progress state as an earlier full
2334  * match, we need to apply the same accept */
2335  if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT) &&
2336  s->app_progress_hook == tx->tx_progress) {
2337  const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
2338  DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
2339  if (fw_accept_to_packet) {
2340  SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
2341  DetectRunAppendDefaultAccept(det_ctx, p);
2342  }
2343  }
2344 }
2345 
2346 static void DetectRunTx(ThreadVars *tv,
2347  DetectEngineCtx *de_ctx,
2348  DetectEngineThreadCtx *det_ctx,
2349  Packet *p,
2350  Flow *f,
2351  DetectRunScratchpad *scratch)
2352 {
2353  const uint8_t flow_flags = scratch->flow_flags;
2354  const SigGroupHead * const sgh = scratch->sgh;
2355  void * const alstate = f->alstate;
2356  const uint8_t ipproto = f->proto;
2357  const AppProto alproto = f->alproto;
2358 
2359  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
2360  uint64_t tx_id_min = AppLayerParserGetTransactionInspectId(f->alparser, flow_flags);
2361  const int tx_end_state = AppLayerParserGetStateProgressCompletionStatus(alproto, flow_flags);
2362 
2363  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
2364  AppLayerGetTxIterState state = { 0 };
2365 
2366  uint32_t tx_inspected = 0;
2367  const bool have_fw_rules = EngineModeIsFirewall();
2368  /* if we skipped the last tx, we did not have a chance to apply a fw accept to the packet. Since
2369  * the tx is skipped, we should consider it accepted. */
2370  bool last_tx_skipped = false;
2371 
2372  SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
2373  SCLogDebug("total_txs %" PRIu64, total_txs);
2374 
2375  while (1) {
2376  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);
2377  if (ires.tx_ptr == NULL) {
2378  SCLogDebug("%p/%" PRIu64 " no transaction to inspect", ires.tx_ptr, tx_id_min);
2379  break;
2380  }
2381 
2382  DetectTransaction tx =
2383  GetDetectTx(ipproto, alproto, ires.tx_id, ires.tx_ptr, tx_end_state, flow_flags);
2384  if (tx.tx_ptr == NULL) {
2385  SCLogDebug("%p/%"PRIu64" no transaction to inspect",
2386  tx.tx_ptr, tx_id_min);
2387  last_tx_skipped = !ires.has_next;
2388  tx_id_min++; // next (if any) run look for +1
2389  goto next;
2390  }
2391  tx.is_last = !ires.has_next;
2392  tx_id_min = tx.tx_id + 1; // next look for cur + 1
2393  tx_inspected++;
2394 
2395  SCLogDebug("%p/%" PRIu64 " txd flags %02x", tx.tx_ptr, tx.tx_id, tx.tx_data_ptr->flags);
2396  SCLogDebug("%p/%" PRIu64 " is_last %s", tx.tx_ptr, tx.tx_id, BOOL2STR(tx.is_last));
2397 
2398  det_ctx->tx_id = tx.tx_id;
2399  det_ctx->tx_id_set = true;
2400  det_ctx->p = p;
2401 
2402  bool do_sort = false; // do we need to sort the tx candidate list?
2403  uint32_t array_idx = 0;
2404  uint32_t total_rules = det_ctx->match_array_cnt;
2405  total_rules += (tx.de_state ? tx.de_state->cnt : 0);
2406 
2407  /* run prefilter engines and merge results into a candidates array */
2408  if (sgh && sgh->tx_engines) {
2409  PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX);
2410  DetectRunPrefilterTx(det_ctx, sgh, p, ipproto, flow_flags, alproto,
2411  alstate, &tx);
2412  PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX);
2413  SCLogDebug("%p/%"PRIu64" rules added from prefilter: %u candidates",
2414  tx.tx_ptr, tx.tx_id, det_ctx->pmq.rule_id_array_cnt);
2415 
2416  total_rules += det_ctx->pmq.rule_id_array_cnt;
2417  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
2418  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2419  }
2420 
2421  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
2422  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
2423  const SigIntId id = s->iid;
2424  det_ctx->tx_candidates[array_idx].s = s;
2425  det_ctx->tx_candidates[array_idx].id = id;
2426  det_ctx->tx_candidates[array_idx].flags = NULL;
2427  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2428  array_idx++;
2429  }
2430  PMQ_RESET(&det_ctx->pmq);
2431  } else {
2432  if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
2433  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2434  }
2435  }
2436 
2437  /* merge 'state' rules from the regular prefilter */
2438 #ifdef PROFILING
2439  uint32_t x = array_idx;
2440 #endif
2441  RuleMatchCandidateMergeStateRules(det_ctx, &array_idx);
2442 
2443  /* merge stored state into results */
2444  if (tx.de_state != NULL) {
2445  const uint32_t old = array_idx;
2446 
2447  /* if tx.de_state->flags has 'new file' set and sig below has
2448  * 'file inspected' flag, reset the file part of the state */
2449  const bool have_new_file = (tx.de_state->flags & DETECT_ENGINE_STATE_FLAG_FILE_NEW);
2450  if (have_new_file) {
2451  SCLogDebug("%p/%"PRIu64" destate: need to consider new file",
2452  tx.tx_ptr, tx.tx_id);
2453  tx.de_state->flags &= ~DETECT_ENGINE_STATE_FLAG_FILE_NEW;
2454  }
2455 
2456  SigIntId state_cnt = 0;
2457  DeStateStore *tx_store = tx.de_state->head;
2458  for (; tx_store != NULL; tx_store = tx_store->next) {
2459  SCLogDebug("tx_store %p", tx_store);
2460 
2461  SigIntId store_cnt = 0;
2462  for (store_cnt = 0;
2463  store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < tx.de_state->cnt;
2464  store_cnt++, state_cnt++)
2465  {
2466  DeStateStoreItem *item = &tx_store->store[store_cnt];
2467  SCLogDebug("rule id %u, inspect_flags %u", item->sid, item->flags);
2468  if (have_new_file && (item->flags & DE_STATE_FLAG_FILE_INSPECT)) {
2469  /* remove part of the state. File inspect engine will now
2470  * be able to run again */
2471  item->flags &= ~(DE_STATE_FLAG_SIG_CANT_MATCH|DE_STATE_FLAG_FULL_INSPECT|DE_STATE_FLAG_FILE_INSPECT);
2472  SCLogDebug("rule id %u, post file reset inspect_flags %u", item->sid, item->flags);
2473  }
2474  det_ctx->tx_candidates[array_idx].s = de_ctx->sig_array[item->sid];
2475  det_ctx->tx_candidates[array_idx].id = item->sid;
2476  det_ctx->tx_candidates[array_idx].flags = &item->flags;
2477  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2478  array_idx++;
2479  }
2480  }
2481  do_sort |= (old && old != array_idx); // sort if continue list adds sids
2482  SCLogDebug("%p/%" PRIu64 " rules added from 'continue' list: %u", tx.tx_ptr, tx.tx_id,
2483  array_idx - old);
2484  }
2485  if (do_sort) {
2486  qsort(det_ctx->tx_candidates, array_idx, sizeof(RuleMatchCandidateTx),
2487  DetectRunTxSortHelper);
2488  }
2489 
2490 #ifdef PROFILING
2491  if (array_idx >= de_ctx->profile_match_logging_threshold)
2492  RulesDumpTxMatchArray(det_ctx, scratch->sgh, p, tx.tx_id, array_idx, x);
2493 #endif
2494 
2495 #ifdef DEBUG
2496  for (uint32_t i = 0; i < array_idx; i++) {
2497  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
2498  const Signature *s = det_ctx->tx_candidates[i].s;
2499  SCLogDebug("%u: sid %u flags %p", i, s->id, can->flags);
2500  }
2501 #endif
2502 
2503  struct DetectFirewallAppTxState fw_state = {
2504  false,
2505  false,
2506  0,
2507  false,
2508  false,
2509  false,
2510  };
2511 
2512  SCLogDebug("%s: tx_progress %u tx %p have_fw_rules %s array_idx %u detect_progress_orig %u "
2513  "cur detect_progress %u",
2514  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
2515  tx.tx_data_ptr, BOOL2STR(have_fw_rules), array_idx, tx.detect_progress_orig,
2516  tx.detect_progress);
2517 
2518  if (have_fw_rules) {
2519  /* if there are no firewall rules to consider, handle invoking the default
2520  * policies. */
2521  const int r = DetectTxFirewallNoRulesApplyPolicies(
2522  det_ctx, p, f, &tx, alproto, flow_flags, array_idx);
2523  if (r == 1) {
2524  SCLogDebug("done");
2525  return;
2526  } else if (r == 2) {
2527  goto next_tx_fw; /* next tx, need to clean up buffers */
2528  }
2529  }
2530 
2531  /* run rules: inspect the match candidates */
2532  for (uint32_t i = 0; i < array_idx; i++) {
2533  RuleMatchCandidateTx *can = &det_ctx->tx_candidates[i];
2534  const Signature *s = det_ctx->tx_candidates[i].s;
2535  uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags;
2536 
2537  SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", PcapPacketCntGet(p), s->id,
2538  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
2539  tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook);
2540 
2541  if (have_fw_rules) {
2542  const enum DetectTxFirewallFlowControl fw_r =
2543  DetectRunTxPreCheckFirewallPolicy(det_ctx, p, &tx,
2544  flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT), s, i, &fw_state);
2545  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2546  "skip_before_progress:%u fw_last_for_progress:%s "
2547  "fw_next_progress_missing:%s",
2548  BOOL2STR(fw_state.fw_skip_app_filter), BOOL2STR(fw_state.skip_fw_hook),
2549  fw_state.skip_before_progress, BOOL2STR(fw_state.fw_last_for_progress),
2550  BOOL2STR(fw_state.fw_next_progress_missing));
2551  if (fw_r == DETECT_TX_FW_FC_SKIP) {
2552  continue;
2553  } else if (fw_r == DETECT_TX_FW_FC_BREAK) {
2554  break;
2555  }
2556 
2557  fw_state.fw_last_for_progress = false;
2558  fw_state.fw_next_progress_missing = false; // reset
2559  }
2560 
2561  /* deduplicate: rules_array is sorted, but not deduplicated:
2562  * both mpm and stored state could give us the same sid.
2563  * As they are back to back in that case we can check for it
2564  * here. We select the stored state one as that comes first
2565  * in the array. */
2566  while ((i + 1) < array_idx &&
2567  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
2568  SCLogDebug("%p/%" PRIu64 " inspecting SKIP NEXT: sid %u (%u), flags %08x",
2569  tx.tx_ptr, tx.tx_id, s->id, s->iid, inspect_flags ? *inspect_flags : 0);
2570  i++;
2571  }
2572 
2573  SCLogDebug("%p/%" PRIu64 " inspecting: sid %u (%u), flags %08x", tx.tx_ptr, tx.tx_id,
2574  s->id, s->iid, inspect_flags ? *inspect_flags : 0);
2575 
2576  if (inspect_flags) {
2577  if (*inspect_flags & DE_STATE_FLAG_FULL_INSPECT) {
2578  SCLogDebug("%p/%" PRIu64
2579  " inspecting: sid %u (%u), flags %08x DE_STATE_FLAG_FULL_INSPECT",
2580  tx.tx_ptr, tx.tx_id, s->id, s->iid, *inspect_flags);
2581 
2582  /* if we're still in the same progress state as an earlier full
2583  * match, we need to apply the same accept */
2584  if (have_fw_rules) {
2585  DetectRunTxFirewallRuleStatefulReApplyMatch(
2586  det_ctx, s, &tx, &fw_state, p, flow_flags);
2587  }
2588  continue;
2589  }
2590  if (*inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) {
2591  SCLogDebug("%p/%" PRIu64
2592  " inspecting: sid %u (%u), flags %08x DE_STATE_FLAG_SIG_CANT_MATCH",
2593  tx.tx_ptr, tx.tx_id, s->id, s->iid, *inspect_flags);
2594  continue;
2595  }
2596 
2597  /* continue previous inspection */
2598  SCLogDebug("%p/%" PRIu64 " Continuing sid %u", tx.tx_ptr, tx.tx_id, s->id);
2599  } else {
2600  /* start new inspection */
2601  SCLogDebug("%p/%"PRIu64" Start sid %u", tx.tx_ptr, tx.tx_id, s->id);
2602  }
2603 
2604  if (have_fw_rules) {
2605  /* check if we should run this rule and update the firewall flow state */
2606  const enum DetectTxFirewallFlowControl fw_r =
2607  DetectRunTxCheckRuleState(det_ctx, p, f, &tx, s, i, array_idx, &fw_state);
2608  SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
2609  "skip_before_progress:%u fw_last_for_progress:%s "
2610  "fw_next_progress_missing:%s",
2611  BOOL2STR(fw_state.fw_skip_app_filter), BOOL2STR(fw_state.skip_fw_hook),
2612  fw_state.skip_before_progress, BOOL2STR(fw_state.fw_last_for_progress),
2613  BOOL2STR(fw_state.fw_next_progress_missing));
2614  if (fw_r == DETECT_TX_FW_FC_SKIP)
2615  continue;
2616  else if (fw_r == DETECT_TX_FW_FC_BREAK)
2617  break;
2618  }
2619 
2620  /* call individual rule inspection */
2621  RULE_PROFILING_START(p);
2622  const int r = DetectRunTxInspectRule(tv, de_ctx, det_ctx, p, f, flow_flags,
2623  alstate, &tx, s, inspect_flags, can, scratch);
2624  SCLogDebug("s %u r %d", s->id, r);
2625  if (r == 1) {
2626  /* match */
2627  DetectRunPostMatch(tv, det_ctx, p, s);
2628 
2629  SCLogDebug(
2630  "%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid);
2631 
2632  if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
2633  AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, tx.tx_type, 0);
2634  } else {
2635  DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
2636  }
2637  } else if (r == 0) {
2638  SCLogDebug("sid %u partial match", s->id);
2639  if (DetectRunTxFirewallRulePartialMatch(det_ctx, s, &tx, p) == 1) {
2640  break;
2641  }
2642  } else {
2643  if (DetectRunTxFirewallRuleNoMatch(det_ctx, s, &tx, &fw_state, p, flow_flags) ==
2644  1) {
2645  return;
2646  }
2647  }
2648  DetectVarProcessList(det_ctx, p->flow, p);
2649  RULE_PROFILING_END(det_ctx, s, r, p);
2650 
2651  if (det_ctx->post_rule_work_queue.len > 0) {
2652  SCLogDebug("%p/%" PRIu64 " post_rule_work_queue len %u", tx.tx_ptr, tx.tx_id,
2653  det_ctx->post_rule_work_queue.len);
2654  /* run post match prefilter engines on work queue */
2655  PrefilterPostRuleMatch(det_ctx, scratch->sgh, p, f);
2656 
2657  uint32_t prev_array_idx = array_idx;
2658  for (uint32_t j = 0; j < det_ctx->pmq.rule_id_array_cnt; j++) {
2659  const Signature *ts = de_ctx->sig_array[det_ctx->pmq.rule_id_array[j]];
2660  if (ts->app_inspect != NULL) {
2661  const SigIntId id = ts->iid;
2662  det_ctx->tx_candidates[array_idx].s = ts;
2663  det_ctx->tx_candidates[array_idx].id = id;
2664  det_ctx->tx_candidates[array_idx].flags = NULL;
2665  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2666  array_idx++;
2667 
2668  SCLogDebug("%p/%" PRIu64 " rule %u (%u) added from 'post match' prefilter",
2669  tx.tx_ptr, tx.tx_id, ts->id, id);
2670  }
2671  }
2672  SCLogDebug("%p/%" PRIu64 " rules added from 'post match' prefilter: %u", tx.tx_ptr,
2673  tx.tx_id, array_idx - prev_array_idx);
2674  if (prev_array_idx != array_idx) {
2675  /* sort, but only part of array we're still going to process */
2676  qsort(det_ctx->tx_candidates + i, array_idx - i, sizeof(RuleMatchCandidateTx),
2677  DetectRunTxSortHelper);
2678  }
2679  det_ctx->post_rule_work_queue.len = 0;
2680  PMQ_RESET(&det_ctx->pmq);
2681  }
2682  }
2683 
2684  det_ctx->tx_id = 0;
2685  det_ctx->tx_id_set = false;
2686  det_ctx->p = NULL;
2687 
2688  /* see if we have any updated state to store in the tx */
2689 
2690  /* this side of the tx is done */
2691  if (tx.tx_progress >= tx.tx_end_state) {
2692  SCLogDebug("%" PRIu64 ": %s tx done", PcapPacketCntGet(p),
2693  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
2694  const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER)
2695  ? APP_LAYER_TX_INSPECTED_TS
2696  : APP_LAYER_TX_INSPECTED_TC;
2697  tx.tx_data_ptr->flags |= inspected_flag;
2698  SCLogDebug("%p/%" PRIu64 " tx is done for direction %s. Progress %02x", tx.tx_ptr,
2699  tx.tx_id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient",
2700  tx.detect_progress);
2701  }
2702 
2703  if (tx.detect_progress != tx.detect_progress_orig) {
2704  SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", PcapPacketCntGet(p),
2705  flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig,
2706  tx.detect_progress);
2707  SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id,
2708  tx.detect_progress, tx.detect_progress_orig);
2709 
2710  StoreDetectProgress(&tx, flow_flags, tx.detect_progress);
2711  }
2712  next_tx_fw:
2713  InspectionBufferClean(det_ctx);
2714 
2715  next:
2716  if (!ires.has_next)
2717  break;
2718  }
2719 
2720  SCLogDebug("packet %" PRIu64 ": tx_inspected %u", PcapPacketCntGet(p), tx_inspected);
2721  if (have_fw_rules) {
2722  if (tx_inspected == 0) {
2723  /* if all tables have been bypassed, we accept:packet */
2724  SCLogDebug("default accept: no app inspect performed");
2725  DetectRunAppendDefaultAccept(det_ctx, p);
2726  } else if (last_tx_skipped) {
2727  /* if the last tx was skipped, we need to apply accept:packet */
2728  // TODO should we check drops first?
2729  DEBUG_VALIDATE_BUG_ON(p->action & ACTION_DROP);
2730  SCLogDebug("default accept: last tx skipped");
2731  DetectRunAppendDefaultAccept(det_ctx, p);
2732  }
2733  }
2734 }
2735 
2736 static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2737  Packet *p, Flow *f, DetectRunScratchpad *scratch)
2738 {
2739  const SigGroupHead *const sgh = scratch->sgh;
2740  const AppProto alproto = f->alproto;
2741 
2742  /* for TCP, limit inspection to pseudo packets or real packet that did
2743  * an app-layer update. */
2744  if (p->proto == IPPROTO_TCP && !PKT_IS_PSEUDOPKT(p) &&
2745  ((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) ||
2746  (PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) {
2747  SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE",
2748  PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
2749  return;
2750  }
2751  FramesContainer *frames_container = AppLayerFramesGetContainer(f);
2752  if (frames_container == NULL) {
2753  return;
2754  }
2755  Frames *frames;
2756  if (PKT_IS_TOSERVER(p)) {
2757  frames = &frames_container->toserver;
2758  } else {
2759  frames = &frames_container->toclient;
2760  }
2761 
2762  for (uint32_t idx = 0; idx < frames->cnt; idx++) {
2763  SCLogDebug("frame %u", idx);
2764  Frame *frame = FrameGetByIndex(frames, idx);
2765  if (frame == NULL) {
2766  continue;
2767  }
2768 
2769  det_ctx->frame_inspect_progress = 0;
2770  uint32_t array_idx = 0;
2771  uint32_t total_rules = det_ctx->match_array_cnt;
2772 
2773  /* run prefilter engines and merge results into a candidates array */
2774  if (sgh->frame_engines) {
2775  // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX);
2776  DetectRunPrefilterFrame(det_ctx, sgh, p, frames, frame, alproto);
2777  // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX);
2778  SCLogDebug("%p/%" PRIi64 " rules added from prefilter: %u candidates", frame, frame->id,
2779  det_ctx->pmq.rule_id_array_cnt);
2780 
2781  total_rules += det_ctx->pmq.rule_id_array_cnt;
2782 
2783  if (!(RuleMatchCandidateTxArrayHasSpace(
2784  det_ctx, total_rules))) { // TODO is it safe to overload?
2785  RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);
2786  }
2787 
2788  for (uint32_t i = 0; i < det_ctx->pmq.rule_id_array_cnt; i++) {
2789  const Signature *s = de_ctx->sig_array[det_ctx->pmq.rule_id_array[i]];
2790  const SigIntId id = s->iid;
2791  det_ctx->tx_candidates[array_idx].s = s;
2792  det_ctx->tx_candidates[array_idx].id = id;
2793  det_ctx->tx_candidates[array_idx].flags = NULL;
2794  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2795  array_idx++;
2796  }
2797  PMQ_RESET(&det_ctx->pmq);
2798  }
2799  /* merge 'state' rules from the regular prefilter */
2800  uint32_t x = array_idx;
2801  for (uint32_t i = 0; i < det_ctx->match_array_cnt; i++) {
2802  const Signature *s = det_ctx->match_array[i];
2803  if (s->frame_inspect != NULL) {
2804  const SigIntId id = s->iid;
2805  det_ctx->tx_candidates[array_idx].s = s;
2806  det_ctx->tx_candidates[array_idx].id = id;
2807  det_ctx->tx_candidates[array_idx].flags = NULL;
2808  det_ctx->tx_candidates[array_idx].stream_reset = 0;
2809  array_idx++;
2810 
2811  SCLogDebug("%p/%" PRIi64 " rule %u (%u) added from 'match' list", frame, frame->id,
2812  s->id, id);
2813  }
2814  }
2815  SCLogDebug("%p/%" PRIi64 " rules added from 'match' list: %u", frame, frame->id,
2816  array_idx - x);
2817  (void)x;
2818 
2819  /* run rules: inspect the match candidates */
2820  for (uint32_t i = 0; i < array_idx; i++) {
2821  const Signature *s = det_ctx->tx_candidates[i].s;
2822 
2823  /* deduplicate: rules_array is sorted, but not deduplicated.
2824  * As they are back to back in that case we can check for it
2825  * here. We select the stored state one as that comes first
2826  * in the array. */
2827  while ((i + 1) < array_idx &&
2828  det_ctx->tx_candidates[i].s == det_ctx->tx_candidates[i + 1].s) {
2829  i++;
2830  }
2831  SCLogDebug("%p/%" PRIi64 " inspecting: sid %u (%u)", frame, frame->id, s->id, s->iid);
2832 
2833  /* start new inspection */
2834  SCLogDebug("%p/%" PRIi64 " Start sid %u", frame, frame->id, s->id);
2835 
2836  /* call individual rule inspection */
2837  RULE_PROFILING_START(p);
2838  bool r = DetectRunInspectRuleHeader(p, f, s, s->flags);
2839  if (r) {
2840  r = DetectRunFrameInspectRule(tv, det_ctx, s, f, p, frames, frame);
2841  if (r) {
2842  /* match */
2843  DetectRunPostMatch(tv, det_ctx, p, s);
2844  det_ctx->frame_id = frame->id;
2845  SCLogDebug(
2846  "%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->iid);
2847  const uint8_t alert_flags =
2848  (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
2849  if (frame->flags & FRAME_FLAG_TX_ID_SET) {
2850  const uint8_t ipproto = p->proto;
2851  uint8_t sub_state = 0;
2852  void *tx = AppLayerParserGetTx(
2853  ipproto, alproto, p->flow->alstate, frame->tx_id);
2854  if (tx) {
2855  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
2856  sub_state = txd->tx_type;
2857  }
2858  AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, sub_state, alert_flags);
2859  } else {
2860  AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
2861  }
2862  }
2863  }
2864  DetectVarProcessList(det_ctx, p->flow, p);
2865  RULE_PROFILING_END(det_ctx, s, r, p);
2866  }
2867 
2868  /* update Frame::inspect_progress here instead of in the code above. The reason is that a
2869  * frame might be used more than once in buffers with transforms. */
2870  if (frame->inspect_progress < det_ctx->frame_inspect_progress) {
2871  frame->inspect_progress = det_ctx->frame_inspect_progress;
2872  SCLogDebug("frame->inspect_progress: %" PRIu64 " -> updated", frame->inspect_progress);
2873  } else {
2874  SCLogDebug(
2875  "frame->inspect_progress: %" PRIu64 " -> not updated", frame->inspect_progress);
2876  }
2877 
2878  SCLogDebug("%p/%" PRIi64 " rules inspected, running cleanup", frame, frame->id);
2879  InspectionBufferClean(det_ctx);
2880  }
2881 }
2882 
2883 static DetectEngineThreadCtx *GetTenantById(HashTable *h, uint32_t id)
2884 {
2885  /* technically we need to pass a DetectEngineThreadCtx struct with the
2886  * tenant_id member. But as that member is the first in the struct, we
2887  * can use the id directly. */
2888  return HashTableLookup(h, &id, 0);
2889 }
2890 
2891 static void DetectFlow(ThreadVars *tv,
2892  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2893  Packet *p)
2894 {
2895  Flow *const f = p->flow;
2896 
2897  /* we check the flow drop here, and not the packet drop. This is
2898  * to allow stream engine "invalid" drop packets to still be
2899  * evaluated by the stream event rules. */
2900  if (f->flags & FLOW_ACTION_DROP) {
2901  DEBUG_VALIDATE_BUG_ON(!(PKT_IS_PSEUDOPKT(p)) && !PacketCheckAction(p, ACTION_DROP));
2902  SCReturn;
2903  }
2904 
2905  /* in firewall mode, we still need to run the fw rulesets even for exception policy pass */
2906  bool skip = (p->flags & PKT_NOPACKET_INSPECTION || f->flags & (FLOW_ACTION_PASS));
2907  if (EngineModeIsFirewall() && (f->flags & FLOW_ACTION_ACCEPT) == 0) {
2908  skip = false;
2909  }
2910  if (skip) {
2911  /* enforce prior accept:flow */
2912  if (f->flags & FLOW_ACTION_ACCEPT) {
2913  p->action |= ACTION_ACCEPT;
2914  }
2915  /* hack: if we are in pass the entire flow mode, we need to still
2916  * update the inspect_id forward. So test for the condition here,
2917  * and call the update code if necessary. */
2918  const int pass = (f->flags & (FLOW_ACTION_PASS | FLOW_ACTION_ACCEPT));
2919  if (pass) {
2920  uint8_t flags = STREAM_FLAGS_FOR_PACKET(p);
2921  flags = FlowGetDisruptionFlags(f, flags);
2922  if (f->alstate) {
2923  AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true);
2924  }
2925  }
2926  SCLogDebug("p->pcap %" PRIu64 ": no detection on packet, "
2927  "PKT_NOPACKET_INSPECTION is set",
2928  PcapPacketCntGet(p));
2929  return;
2930  }
2931 
2932  /* see if the packet matches one or more of the sigs */
2933  DetectRun(tv, de_ctx, det_ctx, p);
2934 }
2935 
2936 
2937 static void DetectNoFlow(ThreadVars *tv,
2938  DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
2939  Packet *p)
2940 {
2941  /* No need to perform any detection on this packet, if the given flag is set.*/
2942  if ((p->flags & PKT_NOPACKET_INSPECTION) || (PacketCheckAction(p, ACTION_DROP))) {
2943  return;
2944  }
2945 
2946  /* see if the packet matches one or more of the sigs */
2947  DetectRun(tv, de_ctx, det_ctx, p);
2948 }
2949 
2950 uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
2951 {
2952  const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
2953  const SigGroupHead *sgh = de_ctx->pre_flow_sgh;
2954 
2955  SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
2956  DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p, DETECT_FIREWALL_POLICY_PRE_FLOW);
2957  return p->action;
2958 }
2959 
2960 uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
2961 {
2962  const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
2963  const int direction = (PKT_IS_TOCLIENT(p) != 0);
2964  const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction];
2965 
2966  SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
2967  DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p, DETECT_FIREWALL_POLICY_PRE_STREAM);
2968  return p->action;
2969 }
2970 
2971 /** \brief Detection engine thread wrapper.
2972  * \param tv thread vars
2973  * \param p packet to inspect
2974  * \param data thread specific data
2975  * \param pq packet queue
2976  * \retval TM_ECODE_FAILED error
2977  * \retval TM_ECODE_OK ok
2978  */
2979 TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
2980 {
2981  DEBUG_VALIDATE_PACKET(p);
2982 
2983  DetectEngineCtx *de_ctx = NULL;
2984  DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
2985  if (det_ctx == NULL) {
2986  printf("ERROR: Detect has no thread ctx\n");
2987  goto error;
2988  }
2989 
2990  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
2991  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
2992  SCLogDebug("Detect Engine using new det_ctx - %p",
2993  det_ctx);
2994  }
2995 
2996  /* if in MT mode _and_ we have tenants registered, use
2997  * MT logic. */
2998  if (det_ctx->mt_det_ctxs_cnt > 0 && det_ctx->TenantGetId != NULL)
2999  {
3000  uint32_t tenant_id = p->tenant_id;
3001  if (tenant_id == 0)
3002  tenant_id = det_ctx->TenantGetId(det_ctx, p);
3003  if (tenant_id > 0 && tenant_id < det_ctx->mt_det_ctxs_cnt) {
3004  p->tenant_id = tenant_id;
3005  det_ctx = GetTenantById(det_ctx->mt_det_ctxs_hash, tenant_id);
3006  if (det_ctx == NULL)
3007  return TM_ECODE_OK;
3008  de_ctx = det_ctx->de_ctx;
3009  if (de_ctx == NULL)
3010  return TM_ECODE_OK;
3011 
3012  if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) {
3013  (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1);
3014  SCLogDebug("MT de_ctx %p det_ctx %p (tenant %u)", de_ctx, det_ctx, tenant_id);
3015  }
3016  } else {
3017  /* use default if no tenants are registered for this packet */
3018  de_ctx = det_ctx->de_ctx;
3019  }
3020  } else {
3021  de_ctx = det_ctx->de_ctx;
3022  }
3023 
3024  if (p->flow) {
3025  DetectFlow(tv, de_ctx, det_ctx, p);
3026  } else {
3027  DetectNoFlow(tv, de_ctx, det_ctx, p);
3028  }
3029 
3030 #ifdef PROFILE_RULES
3031  /* aggregate statistics */
3032  struct timeval ts;
3033  gettimeofday(&ts, NULL);
3034  if (ts.tv_sec != det_ctx->rule_perf_last_sync) {
3035  SCProfilingRuleThreatAggregate(det_ctx);
3036  det_ctx->rule_perf_last_sync = ts.tv_sec;
3037  }
3038 #endif
3039 
3040  return TM_ECODE_OK;
3041 error:
3042  return TM_ECODE_FAILED;
3043 }
3044 
3045 /** \brief disable file features we don't need
3046  * Called if we have no detection engine.
3047  */
3048 void DisableDetectFlowFileFlags(Flow *f)
3049 {
3050  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOSERVER);
3051  DetectPostInspectFileFlagsUpdate(f, NULL /* no sgh */, STREAM_TOCLIENT);
3052 }
3053 
3054 #if defined(UNITTESTS) || defined(FUZZ)
3055 /**
3056  * \brief wrapper for old tests
3057  */
3058 void SigMatchSignatures(
3059  ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
3060 {
3061  if (p->flow) {
3062  DetectFlow(tv, de_ctx, det_ctx, p);
3063  } else {
3064  DetectNoFlow(tv, de_ctx, det_ctx, p);
3065  }
3066 }
3067 #endif
3068 
3069 /*
3070  * TESTS
3071  */
3072 
3073 #ifdef UNITTESTS
3074 #include "tests/detect.c"
3075 #endif
PKT_IS_TOCLIENT
#define PKT_IS_TOCLIENT(p)
Definition: decode.h:240
default_accept
thread_local Signature default_accept
Definition: detect.c:2061
DetectEngineAppInspectionEngine_::stream
bool stream
Definition: detect.h:421
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:50
FLOWFILE_NO_MD5_TS
#define FLOWFILE_NO_MD5_TS
Definition: flow.h:142
RulesDumpTxMatchArray
void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt, const uint32_t pkt_prefilter_cnt)
Definition: detect-engine-profile.c:34
SIG_GROUP_HEAD_HAVEFILEMD5
#define SIG_GROUP_HEAD_HAVEFILEMD5
Definition: detect.h:1551
DETECT_TX_FW_FC_SKIP
@ DETECT_TX_FW_FC_SKIP
Definition: detect.c:1177
DetectFirewallPolicies
Definition: detect.h:948
PACKET_ALERT_FLAG_TX_GUESSED
#define PACKET_ALERT_FLAG_TX_GUESSED
Definition: decode.h:280
FLOWFILE_NO_MD5_TC
#define FLOWFILE_NO_MD5_TC
Definition: flow.h:143
SigGroupHead_::tx_engines
PrefilterEngine * tx_engines
Definition: detect.h:1705
DetectEngineAppInspectionEngine_
Definition: detect.h:416
Packet_::proto
uint8_t proto
Definition: decode.h:538
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-prefilter.h:34
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:420
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:55
RuleMatchCandidateTx::stream_stored
bool stream_stored
Definition: detect.h:1259
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:53
DetectEngineThreadCtx_::alert_queue_size
uint16_t alert_queue_size
Definition: detect.h:1385
PROF_DETECT_GETSGH
@ PROF_DETECT_GETSGH
Definition: suricata-common.h:466
ts
uint64_t ts
Definition: source-erf-file.c:55
AppLayerTxData::flags
uint8_t flags
Definition: app-layer-parser.h:176
PacketAlerts_::firewall_discarded
uint16_t firewall_discarded
Definition: decode.h:291
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@82 v2
SCAppLayerParserStateIssetFlag
uint16_t SCAppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:2105
FLOW_ACTION_BY_FIREWALL
#define FLOW_ACTION_BY_FIREWALL
Definition: flow.h:125
detect-engine.h
detect-engine-proto.h
DetectEngineThreadCtx_::match_array_cnt
SigIntId match_array_cnt
Definition: detect.h:1399
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:52
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:91
DetectEngineThreadCtx_::counter_alerts
StatsCounterId counter_alerts
Definition: detect.h:1345
detect-dsize.h
Signature_::addr_src_match6
DetectMatchAddressIPv6 * addr_src_match6
Definition: detect.h:725
Flow_::flags
uint64_t flags
Definition: flow.h:403
SIG_FLAG_FW_HOOK_LTE
#define SIG_FLAG_FW_HOOK_LTE
Definition: detect.h:251
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1311
DetectEngineCtx_::decoder_event_sgh
struct SigGroupHead_ * decoder_event_sgh
Definition: detect.h:1070
FlowGetPacketDirection
int FlowGetPacketDirection(const Flow *f, const Packet *p)
determine the direction of the packet compared to the flow
Definition: flow.c:286
DetectEngineCtx_::flow_gh
DetectEngineLookupFlow flow_gh[FLOW_STATES]
Definition: detect.h:1009
DETECT_TABLE_APP_FILTER
@ DETECT_TABLE_APP_FILTER
Definition: detect.h:563
DE_STATE_FLAG_SIG_CANT_MATCH
#define DE_STATE_FLAG_SIG_CANT_MATCH
Definition: detect-engine-state.h:59
DetectFirewallAppPolicy
Definition: detect.h:937
DetectEngineAppInspectionEngine_::next
struct DetectEngineAppInspectionEngine_ * next
Definition: detect.h:442
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
detect-engine-siggroup.h
SigGroupHead_::flags
uint16_t flags
Definition: detect.h:1694
PostRuleMatchWorkQueue::len
uint32_t len
Definition: detect.h:1283
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1364
DetectEngineState_
Definition: detect-engine-state.h:95
stream-tcp.h
PrefilterRuleStore_::rule_id_array_cnt
uint32_t rule_id_array_cnt
Definition: util-prefilter.h:40
detect-engine-event.h
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1693
PACKET_ALERT_FLAG_STATE_MATCH
#define PACKET_ALERT_FLAG_STATE_MATCH
Definition: decode.h:270
DetectEngineCtx_::guess_applayer
bool guess_applayer
Definition: detect.h:1032
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
detect.c
AppLayerTxData::tx_type
uint8_t tx_type
Definition: app-layer-parser.h:209
SC_ATOMIC_SET
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
Definition: util-atomic.h:386
PKT_DROP_REASON_FW_RULES
@ PKT_DROP_REASON_FW_RULES
Definition: decode.h:407
Signature_::app_progress_hook
uint8_t app_progress_hook
Definition: detect.h:719
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(const Flow *f)
Definition: app-layer-parser.c:201
KEYWORD_PROFILING_SET_LIST
#define KEYWORD_PROFILING_SET_LIST(ctx, list)
Definition: util-profiling.h:46
DetectAddressMatchIPv4
int DetectAddressMatchIPv4(const DetectMatchAddressIPv4 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1587
PcapPacketCntGet
uint64_t PcapPacketCntGet(const Packet *p)
Definition: decode.c:1180
DetectEngineAppInspectionEngine_::Callback
InspectEngineFuncPtr Callback
Definition: detect.h:435
Signature_::alproto
AppProto alproto
Definition: detect.h:687
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:74
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:836
DETECT_TX_FW_FC_OK
@ DETECT_TX_FW_FC_OK
Definition: detect.c:1176
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:89
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:775
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SigMatchData_::is_last
bool is_last
Definition: detect.h:367
AppLayerTxData::de_state
DetectEngineState * de_state
Definition: app-layer-parser.h:217
InspectionBufferClean
void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
Definition: detect-engine-inspect-buffer.c:30
Flow_::proto
uint8_t proto
Definition: flow.h:376
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:87
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:289
DetectEngineThreadCtx_::tx_id
uint64_t tx_id
Definition: detect.h:1376
SCFlowGetAppProtocol
AppProto SCFlowGetAppProtocol(const Flow *f)
Definition: flow.c:1245
SigMatchData_::ctx
SigMatchCtx * ctx
Definition: detect.h:368
AppLayerParserGetStateProgressCompletionStatus
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1252
action-globals.h
FLOWFILE_NO_MAGIC_TS
#define FLOWFILE_NO_MAGIC_TS
Definition: flow.h:134
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:72
Packet_::flags
uint32_t flags
Definition: decode.h:562
Packet_::action
uint8_t action
Definition: decode.h:624
ICMPV4_DEST_UNREACH_IS_VALID
#define ICMPV4_DEST_UNREACH_IS_VALID(p)
Definition: decode-icmpv4.h:253
Frame
Definition: app-layer-frames.h:43
Flow_
Flow data structure.
Definition: flow.h:354
DetectFirewallPacketPolicies
DetectFirewallPacketPolicies
Definition: detect.h:924
PROF_DETECT_ALERT
@ PROF_DETECT_ALERT
Definition: suricata-common.h:477
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1408
SIG_GROUP_HEAD_HAVEFILESHA1
#define SIG_GROUP_HEAD_HAVEFILESHA1
Definition: detect.h:1553
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:41
FLOW_TC_APP_UPDATED
#define FLOW_TC_APP_UPDATED
Definition: flow.h:119
th_v
ThreadVars * th_v
Definition: fuzz_iprep.c:20
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:981
DetectEngineCtx_::pre_stream_sgh
struct SigGroupHead_ * pre_stream_sgh[2]
Definition: detect.h:1211
DETECT_PROTO_ETHERNET
#define DETECT_PROTO_ETHERNET
Definition: detect-engine-proto.h:33
DetectRunScratchpad
struct DetectRunScratchpad DetectRunScratchpad
DetectFirewallAppPolicy::policy
struct DetectFirewallPolicy policy
Definition: detect.h:942
PROF_DETECT_PF_TX
@ PROF_DETECT_PF_TX
Definition: suricata-common.h:472
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:59
Frame::id
int64_t id
Definition: app-layer-frames.h:51
DetectFirewallPolicies::pkt_policy_signatures
Signature * pkt_policy_signatures[DETECT_FIREWALL_POLICY_SIZE]
Definition: detect.h:951
DetectEngineThreadCtx_::p
Packet * p
Definition: detect.h:1380
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:96
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:145
RuleMatchCandidateTx::id
SigIntId id
Definition: detect.h:1255
PROF_DETECT_CLEANUP
@ PROF_DETECT_CLEANUP
Definition: suricata-common.h:479
SIG_FLAG_DST_ANY
#define SIG_FLAG_DST_ANY
Definition: detect.h:241
ACTION_SCOPE_FLOW
@ ACTION_SCOPE_FLOW
Definition: action-globals.h:45
NO_TX
#define NO_TX
Definition: detect.c:1560
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:231
HashTable_
Definition: util-hash.h:35
SIG_FLAG_TXBOTHDIR
#define SIG_FLAG_TXBOTHDIR
Definition: detect.h:249
MIN
#define MIN(x, y)
Definition: suricata-common.h:416
Packet_::sig_mask
SignatureMask sig_mask
Definition: decode.h:553
Frames
Definition: app-layer-frames.h:58
FramesContainer
Definition: app-layer-frames.h:71
DetectFirewallAppTxState::fw_skip_app_filter
bool fw_skip_app_filter
Definition: detect.c:1718
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:296
DetectEngineThreadCtx_::counter_alerts_overflow
StatsCounterId counter_alerts_overflow
Definition: detect.h:1347
DetectRunScratchpad
Definition: detect.c:71
SIG_GROUP_HEAD_HAVERAWSTREAM
#define SIG_GROUP_HEAD_HAVERAWSTREAM
Definition: detect.h:1547
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:69
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
FLOWFILE_NONE
#define FLOWFILE_NONE
Definition: flow.h:166
detect-engine-frame.h
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:3058
Signature_::sm_arrays
SigMatchData * sm_arrays[DETECT_SM_LIST_MAX]
Definition: detect.h:745
proto
uint8_t proto
Definition: decode-template.h:0
m
SCMutex m
Definition: flow-hash.h:6
DetectPort_::sh
struct SigGroupHead_ * sh
Definition: detect.h:230
p
Packet * p
Definition: fuzz_iprep.c:21
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1297
PACKET_PROFILING_DETECT_END
#define PACKET_PROFILING_DETECT_END(p, id)
Definition: util-profiling.h:221
DetectEngineThreadCtx_::counter_alerts_suppressed
StatsCounterId counter_alerts_suppressed
Definition: detect.h:1351
Detect
TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
Detection engine thread wrapper.
Definition: detect.c:2979
detect-engine-payload.h
DetectEngineThreadCtx_::counter_firewall_discarded_alerts
StatsCounterId counter_firewall_discarded_alerts
Definition: detect.h:1349
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:547
EngineModeIsFirewall
bool EngineModeIsFirewall(void)
Definition: suricata.c:239
SIG_FLAG_SRC_ANY
#define SIG_FLAG_SRC_ANY
Definition: detect.h:240
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
DetectRunFrameInspectRule
bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, const Frames *frames, const Frame *frame)
Definition: detect-engine-frame.c:229
Flow_::protoctx
void * protoctx
Definition: flow.h:433
DetectFirewallAppTxState::skip_before_progress
uint8_t skip_before_progress
Definition: detect.c:1720
AppLayerGetTxIterTuple::tx_ptr
void * tx_ptr
Definition: app-layer-parser.h:154
SigMatchData_
Data needed for Match()
Definition: detect.h:365
DetectFirewallAppPolicy::alert_signature
Signature * alert_signature
Definition: detect.h:945
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:77
AppLayerTxData::tx_type_eop_ts
uint8_t tx_type_eop_ts
Definition: app-layer-parser.h:213
RuleMatchCandidateTx::s
const Signature * s
Definition: detect.h:1265
KEYWORD_PROFILING_START
#define KEYWORD_PROFILING_START
Definition: util-profiling.h:50
SigMatchData_::type
uint16_t type
Definition: detect.h:366
DetectEngineCtx_::version
uint32_t version
Definition: detect.h:1066
DetectFirewallPolicy::action
uint8_t action
Definition: detect.h:933
DisableDetectFlowFileFlags
void DisableDetectFlowFileFlags(Flow *f)
disable file features we don't need Called if we have no detection engine.
Definition: detect.c:3048
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:805
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:637
detect-engine-prefilter.h
DetectRunPrefilterFrame
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto)
Definition: detect-engine-frame.c:74
Packet_::events
PacketEngineEvents events
Definition: decode.h:643
Signature_::frame_inspect
DetectEngineFrameInspectionEngine * frame_inspect
Definition: detect.h:741
PROF_DETECT_PF_SORT2
@ PROF_DETECT_PF_SORT2
Definition: suricata-common.h:475
pad
uint16_t pad
Definition: source-erf-file.c:61
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
PacketCreateMask
void PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, bool app_decoder_events)
Definition: detect-engine-build.c:401
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:248
KEYWORD_PROFILING_END
#define KEYWORD_PROFILING_END(ctx, type, m)
Definition: util-profiling.h:64
detect-flowvar.h
DetectEngineThreadCtx_::mt_det_ctxs_hash
HashTable * mt_det_ctxs_hash
Definition: detect.h:1312
PacketAlert_::action
uint8_t action
Definition: decode.h:251
TcpSession_::flags
uint32_t flags
Definition: stream-tcp-private.h:294
DetectEnginePktInspectionRun
bool DetectEnginePktInspectionRun(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
Definition: detect-engine.c:1981
SIG_FLAG_FIREWALL
#define SIG_FLAG_FIREWALL
Definition: detect.h:245
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:486
PROF_DETECT_TX_UPDATE
@ PROF_DETECT_TX_UPDATE
Definition: suricata-common.h:478
DetectEngineAppInspectionEngine_::id
uint8_t id
Definition: detect.h:419
DetectRunStoreStateTx
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
Definition: detect-engine-state.c:213
StatsCounterAvgAddI64
void StatsCounterAvgAddI64(StatsThreadContext *stats, StatsCounterAvgId id, int64_t x)
Definition: counters.c:239
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:424
FLOWFILE_INIT
#define FLOWFILE_INIT
Definition: flow.h:131
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:478
FLOW_ACTION_PASS
#define FLOW_ACTION_PASS
Definition: flow.h:116
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES
Definition: detect-engine-state.h:46
FLOWFILE_NO_SHA1_TC
#define FLOWFILE_NO_SHA1_TC
Definition: flow.h:147
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:127
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:73
DetectEngineCtx_::pre_flow_sgh
struct SigGroupHead_ * pre_flow_sgh
Definition: detect.h:1216
DetectEngineThreadCtx_::tx_candidates
RuleMatchCandidateTx * tx_candidates
Definition: detect.h:1401
SIG_TYPE_PKT
@ SIG_TYPE_PKT
Definition: detect.h:72
Signature_::addr_src_match4
DetectMatchAddressIPv4 * addr_src_match4
Definition: detect.h:722
decode.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:52
DetectEngineCtx_::fw_policies
struct DetectFirewallPolicies * fw_policies
Definition: detect.h:1012
DETECT_PROTO_ARP
#define DETECT_PROTO_ARP
Definition: detect-engine-proto.h:34
TOSERVER
#define TOSERVER
Definition: flow.h:45
DetectTransaction_::tx_end_state
const uint8_t tx_end_state
Definition: detect-engine-prefilter.h:44
DetectEngineThreadCtx_::counter_mpm_list
StatsCounterAvgId counter_mpm_list
Definition: detect.h:1353
AppLayerTxData
Definition: app-layer-parser.h:166
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:239
DetectFirewallAppTxState::skip_fw_hook
bool skip_fw_hook
Definition: detect.c:1719
Prefilter
void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, const SignatureMask mask)
Definition: detect-engine-prefilter.c:237
DetectTransaction_::detect_progress_orig
const uint8_t detect_progress_orig
Definition: detect-engine-prefilter.h:41
DetectEngineThreadCtx_
Definition: detect.h:1300
DEBUG_VALIDATE_PACKET
#define DEBUG_VALIDATE_PACKET(p)
Definition: util-validate.h:108
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:76
PKT_STREAM_ADD
#define PKT_STREAM_ADD
Definition: decode.h:1305
DetectTransaction_::detect_progress
uint8_t detect_progress
Definition: detect-engine-prefilter.h:39
AlertQueueAppendAppTxFromPacket
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing This does not automatically set ...
Definition: detect-engine-alert.c:437
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:425
DetectEngineThreadCtx_::tx_candidates_size
uint32_t tx_candidates_size
Definition: detect.h:1402
FRAME_FLAG_TX_ID_SET
#define FRAME_FLAG_TX_ID_SET
Definition: app-layer-frames.h:36
PKT_PSEUDO_STREAM_END
#define PKT_PSEUDO_STREAM_END
Definition: decode.h:1313
DETECT_TX_FW_FC_BREAK
@ DETECT_TX_FW_FC_BREAK
Definition: detect.c:1178
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1335
BOOL2STR
#define BOOL2STR(b)
Definition: util-debug.h:542
STREAM_FLAGS_FOR_PACKET
#define STREAM_FLAGS_FOR_PACKET(p)
Definition: stream.h:30
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
PMQ_RESET
#define PMQ_RESET(pmq)
Definition: util-prefilter.h:46
detect-engine-mpm.h
DetectEngineLookupFlow_::sgh
struct SigGroupHead_ * sgh[256]
Definition: detect.h:880
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:194
AppLayerGetTxIterTuple::tx_id
uint64_t tx_id
Definition: app-layer-parser.h:155
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:82
DetectTransaction_::is_last
bool is_last
Definition: detect-engine-prefilter.h:45
Packet_::sp
Port sp
Definition: decode.h:523
FLOWFILE_NO_SHA256_TS
#define FLOWFILE_NO_SHA256_TS
Definition: flow.h:150
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:41
PKT_DETECT_HAS_STREAMDATA
#define PKT_DETECT_HAS_STREAMDATA
Definition: decode.h:1350
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:235
DetectFirewallPolicies::pkt
struct DetectFirewallPolicy pkt[DETECT_FIREWALL_POLICY_SIZE]
Definition: detect.h:950
StreamReassembleRawHasDataReady
bool StreamReassembleRawHasDataReady(TcpSession *ssn, Packet *p)
does the stream engine have data to inspect?
Definition: stream-tcp-reassemble.c:1499
detect-engine-port.h
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:881
DetectFirewallAppPolicy::progress
uint8_t progress
Definition: detect.h:940
DetectPort_
Port structure for detection engine.
Definition: detect.h:219
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:290
app-layer-parser.h
Signature_::app_inspect
DetectEngineAppInspectionEngine * app_inspect
Definition: detect.h:739
ThreadVars_::id
int id
Definition: threadvars.h:86
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *tx, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1225
util-detect.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:325
detect-engine-profile.h
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:483
DetectEngineThreadCtx_::base64_decoded_len
int base64_decoded_len
Definition: detect.h:1383
SIG_FLAG_REQUIRE_FLOWVAR
#define SIG_FLAG_REQUIRE_FLOWVAR
Definition: detect.h:266
RuleMatchCandidateTx::stream_result
uint8_t stream_result
Definition: detect.h:1260
Signature_::action
uint8_t action
Definition: detect.h:697
util-profiling.h
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-prefilter.h:33
DetectEngineLookupFlow_::udp
DetectPort * udp
Definition: detect.h:879
DetectEngineThreadCtx_::raw_stream_progress
uint64_t raw_stream_progress
Definition: detect.h:1321
SigIntId
#define SigIntId
Definition: detect-engine-state.h:38
FileUpdateFlowFileFlags
void FileUpdateFlowFileFlags(Flow *f, uint16_t set_file_flags, uint8_t direction)
set a flow's file flags
Definition: util-file.c:1091
SCReturn
#define SCReturn
Definition: util-debug.h:286
Signature_::flags
uint32_t flags
Definition: detect.h:683
RuleMatchCandidateTxArrayFree
void RuleMatchCandidateTxArrayFree(DetectEngineThreadCtx *det_ctx)
Definition: detect.c:1194
AppLayerGetTxIterState
Definition: app-layer-parser.h:142
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
Packet_
Definition: decode.h:516
detect-engine-build.h
ACTION_SCOPE_TX
@ ACTION_SCOPE_TX
Definition: action-globals.h:47
DetectEngineThreadCtx_::frame_id
int64_t frame_id
Definition: detect.h:1377
detect-engine-alert.h
AppLayerTxData::guessed_applayer_logged
uint8_t guessed_applayer_logged
Definition: app-layer-parser.h:196
DetectEngineThreadCtx_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1342
PROF_DETECT_IPONLY
@ PROF_DETECT_IPONLY
Definition: suricata-common.h:467
RULE_PROFILING_END
#define RULE_PROFILING_END(a, b, c, p)
Definition: util-profiling.h:422
TmEcode
TmEcode
Definition: tm-threads-common.h:80
RULE_PROFILING_START
#define RULE_PROFILING_START(p)
Definition: util-profiling.h:421
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:300
DetectPreFlow
uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
Definition: detect.c:2950
DetectTransaction_::de_state
DetectEngineStateDirection * de_state
Definition: detect-engine-prefilter.h:35
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
detect-filestore.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1480
DetectTransaction_::tx_type
const uint8_t tx_type
Definition: detect-engine-prefilter.h:48
DetectFirewallAppTxState::last_fw_rule
bool last_fw_rule
Definition: detect.c:1723
detect-replace.h
AppLayerGetTxIterTuple
Definition: app-layer-parser.h:153
RulesDumpMatchArray
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, const Packet *p)
Definition: detect-engine-profile.c:81
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
Signature_::addr_dst_match6_cnt
uint16_t addr_dst_match6_cnt
Definition: detect.h:709
AppLayerTxData::detect_progress_ts
uint8_t detect_progress_ts
Definition: app-layer-parser.h:204
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:232
SigGroupHead_::frame_engines
PrefilterEngine * frame_engines
Definition: detect.h:1706
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:292
Signature_::sp
DetectPort * sp
Definition: detect.h:733
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1245
DetectRunScratchpad::sgh
const SigGroupHead * sgh
Definition: detect.c:76
PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET
#define PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET
Definition: decode.h:282
DETECT_FIREWALL_POLICY_PRE_STREAM
@ DETECT_FIREWALL_POLICY_PRE_STREAM
Definition: detect.h:927
PacketAlertFinalize
void PacketAlertFinalize(const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
Check the threshold of the sigs that match, set actions, break on pass action This function iterate t...
Definition: detect-engine-alert.c:831
DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH
Definition: detect-engine-state.h:42
DETECT_ENGINE_STATE_FLAG_FILE_NEW
#define DETECT_ENGINE_STATE_FLAG_FILE_NEW
Definition: detect-engine-state.h:73
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:489
RuleMatchCandidateTx::flags
uint32_t * flags
Definition: detect.h:1256
PACKET_ALERT_FLAG_FRAME
#define PACKET_ALERT_FLAG_FRAME
Definition: decode.h:278
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:45
DetectEngineAppInspectionEngine_::alproto
AppProto alproto
Definition: detect.h:417
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-analyzer.h
FLOWFILE_NO_SHA256_TC
#define FLOWFILE_NO_SHA256_TC
Definition: flow.h:151
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:86
DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
#define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES
Definition: detect-engine-state.h:52
DetectEngineCtx_::eth_non_ip_sgh
struct SigGroupHead_ * eth_non_ip_sgh
Definition: detect.h:1073
APP_LAYER_MAX_PROGRESS
#define APP_LAYER_MAX_PROGRESS
Definition: app-layer-parser.h:75
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:40
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
app-layer-frames.h
DetectAddressMatchIPv6
int DetectAddressMatchIPv6(const DetectMatchAddressIPv6 *addrs, uint16_t addrs_cnt, const Address *a)
Match a packets address against a signatures addrs array.
Definition: detect-engine-address.c:1620
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:678
Packet_::flow
struct Flow_ * flow
Definition: decode.h:564
DetectEngineStateResetTxs
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
Definition: detect-engine-state.c:259
FLOWFILE_NO_MAGIC_TC
#define FLOWFILE_NO_MAGIC_TC
Definition: flow.h:135
flags
uint8_t flags
Definition: decode-gre.h:0
SCGenericVarFree
void SCGenericVarFree(GenericVar *gv)
Definition: util-var.c:48
suricata-common.h
SIG_FLAG_SP_ANY
#define SIG_FLAG_SP_ANY
Definition: detect.h:242
ActionScope
ActionScope
Definition: action-globals.h:42
DETECT_FIREWALL_POLICY_PACKET_FILTER
@ DETECT_FIREWALL_POLICY_PACKET_FILTER
Definition: detect.h:925
AppLayerTxData::updated_tc
bool updated_tc
Definition: app-layer-parser.h:173
ACTION_SCOPE_HOOK
@ ACTION_SCOPE_HOOK
Definition: action-globals.h:46
Signature_::action_scope
uint8_t action_scope
Definition: detect.h:704
packet.h
DeStateStore_
Definition: detect-engine-state.h:80
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DetectTransaction_
Definition: detect-engine-prefilter.h:31
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:550
PROF_DETECT_SETUP
@ PROF_DETECT_SETUP
Definition: suricata-common.h:465
DetectEngineStateDirection_
Definition: detect-engine-state.h:85
DetectEngineThreadCtx_::frame_inspect_progress
uint64_t frame_inspect_progress
Definition: detect.h:1378
DetectEngineCtx_::profile_match_logging_threshold
uint32_t profile_match_logging_threshold
Definition: detect.h:1105
FLOW_TS_APP_UPDATED
#define FLOW_TS_APP_UPDATED
Definition: flow.h:118
Signature_::proto
DetectProto * proto
Definition: detect.h:701
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1446
FatalError
#define FatalError(...)
Definition: util-debug.h:517
DetectFirewallAppTxState::fw_next_progress_missing
bool fw_next_progress_missing
Definition: detect.c:1722
AppLayerTxData::tx_type_eop_tc
uint8_t tx_type_eop_tc
toclient end of tx progress value
Definition: app-layer-parser.h:215
AppLayerTxData::detect_progress_tc
uint8_t detect_progress_tc
Definition: app-layer-parser.h:205
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:33
DetectFirewallAppTxState
Definition: detect.c:1717
AlertQueueAppendPacket
void AlertQueueAppendPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing.
Definition: detect-engine-alert.c:447
FLOW_ACTION_ACCEPT
#define FLOW_ACTION_ACCEPT
Definition: flow.h:63
util-validate.h
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-prefilter.h:32
Signature_::addr_src_match6_cnt
uint16_t addr_src_match6_cnt
Definition: detect.h:710
StreamReassembleRawUpdateProgress
void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_t progress)
update stream engine after detection
Definition: stream-tcp-reassemble.c:1545
FLOWFILE_NO_SHA1_TS
#define FLOWFILE_NO_SHA1_TS
Definition: flow.h:146
PROF_DETECT_RULES
@ PROF_DETECT_RULES
Definition: suricata-common.h:468
APP_LAYER_TX_INSPECTED_TS
#define APP_LAYER_TX_INSPECTED_TS
Definition: app-layer-parser.h:51
DetectRunScratchpad::app_decoder_events
const bool app_decoder_events
Definition: detect.c:74
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
Signature_::dp
DetectPort * dp
Definition: detect.h:733
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:292
PACKET_PROFILING_DETECT_START
#define PACKET_PROFILING_DETECT_START(p, id)
Definition: util-profiling.h:214
DetectEngineThreadCtx_::replace
const Signature ** replace
Definition: detect.h:1394
DetectFirewallPolicy
Definition: detect.h:932
PKT_PSEUDO_DETECTLOG_FLUSH
#define PKT_PSEUDO_DETECTLOG_FLUSH
Definition: decode.h:1353
Signature_::iid
SigIntId iid
Definition: detect.h:694
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:72
APP_LAYER_TX_ACCEPT
#define APP_LAYER_TX_ACCEPT
Definition: app-layer-parser.h:54
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:626
DetectEngineAppInspectionEngine_::sub_state
uint8_t sub_state
Definition: detect.h:427
SGH_PROFILING_RECORD
#define SGH_PROFILING_RECORD(det_ctx, sgh)
Definition: util-profiling.h:252
Signature_::addr_dst_match6
DetectMatchAddressIPv6 * addr_dst_match6
Definition: detect.h:724
Flow_::alstate
void * alstate
Definition: flow.h:479
Signature_::id
uint32_t id
Definition: detect.h:727
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:81
DetectEngineCtx_::guess_applayer_log_limit
uint8_t guess_applayer_log_limit
Definition: detect.h:1029
RuleMatchCandidateTx::stream_reset
uint32_t stream_reset
Definition: detect.h:1262
ACTION_SCOPE_PACKET
@ ACTION_SCOPE_PACKET
Definition: action-globals.h:44
detect-engine-iponly.h
detect-parse.h
Signature_
Signature container.
Definition: detect.h:682
flow-bindgen.h
AppLayerGetTxIterTuple::has_next
bool has_next
Definition: app-layer-parser.h:156
PACKET_ALERT_FLAG_TX
#define PACKET_ALERT_FLAG_TX
Definition: decode.h:274
DetectFirewallAppTxState::fw_last_for_progress
bool fw_last_for_progress
Definition: detect.c:1721
PKT_DROP_REASON_FW_DEFAULT_APP_POLICY
@ PKT_DROP_REASON_FW_DEFAULT_APP_POLICY
Definition: decode.h:409
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
TRACE_SID_TXS
#define TRACE_SID_TXS(sid, txs,...)
Definition: detect.c:1257
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:233
DetectEngineThreadCtx_::tx_id_set
bool tx_id_set
Definition: detect.h:1374
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:34
ACTION_ACCEPT
#define ACTION_ACCEPT
Definition: action-globals.h:36
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:201
DetectRunScratchpad::flow_flags
const uint8_t flow_flags
Definition: detect.c:73
DetectEngineThreadCtx_::de_ctx
DetectEngineCtx * de_ctx
Definition: detect.h:1423
suricata.h
IPOnlyMatchPacket
void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineIPOnlyCtx *io_ctx, Packet *p)
Match a packet against the IP Only detection engine contexts.
Definition: detect-engine-iponly.c:1000
DetectEngineCtx_::sig_array
Signature ** sig_array
Definition: detect.h:1000
Packet_::dst
Address dst
Definition: decode.h:521
DETECT_FIREWALL_POLICY_PRE_FLOW
@ DETECT_FIREWALL_POLICY_PRE_FLOW
Definition: detect.h:926
PROF_DETECT_TX
@ PROF_DETECT_TX
Definition: suricata-common.h:469
DetectEngineAppInspectionEngine_::dir
uint8_t dir
Definition: detect.h:418
Signature_::detect_table
uint8_t detect_table
Definition: detect.h:716
PKT_NOPACKET_INSPECTION
#define PKT_NOPACKET_INSPECTION
Definition: decode.h:1292
PrefilterPostRuleMatch
void PrefilterPostRuleMatch(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, Flow *f)
invoke post-rule match "prefilter" engines
Definition: detect-engine-prefilter.c:214
DetectGetInnerTx
void * DetectGetInnerTx(void *tx_ptr, AppProto alproto, AppProto engine_alproto, uint8_t flow_flags)
Definition: detect.c:1267
DetectPreStream
uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
Definition: detect.c:2960
PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY
@ PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY
Definition: decode.h:408
DetectRunScratchpad::alproto
const AppProto alproto
Definition: detect.c:72
DE_STATE_FLAG_FULL_INSPECT
#define DE_STATE_FLAG_FULL_INSPECT
Definition: detect-engine-state.h:58
STREAMTCP_STREAM_FLAG_DISABLE_RAW
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW
Definition: stream-tcp-private.h:238
DetectEngineThreadCtx_::json_content_len
uint8_t json_content_len
Definition: detect.h:1339
DetectEngineThreadCtx_::mt_det_ctxs_cnt
uint32_t mt_det_ctxs_cnt
Definition: detect.h:1310
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:226
likely
#define likely(expr)
Definition: util-optimize.h:32
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1273
DE_STATE_FLAG_FILE_INSPECT
#define DE_STATE_FLAG_FILE_INSPECT
Definition: detect-engine-state.h:63
DetectEngineThreadCtx_::counter_match_list
StatsCounterAvgId counter_match_list
Definition: detect.h:1354
AppLayerParserSupportsSubStates
bool AppLayerParserSupportsSubStates(const AppProto alproto)
Definition: app-layer-parser.c:1382
DetectFirewallAppPolicy::alproto
AppProto alproto
Definition: detect.h:938
DetectFirewallPolicies::app_policies
HashTable * app_policies
Definition: detect.h:954
DetectTransaction_::tx_progress
const uint8_t tx_progress
Definition: detect-engine-prefilter.h:43
DetectEngineCtx_::io_ctx
DetectEngineIPOnlyCtx io_ctx
Definition: detect.h:1023
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
Signature_::addr_dst_match4
DetectMatchAddressIPv4 * addr_dst_match4
Definition: detect.h:721
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1171
TcpSession_
Definition: stream-tcp-private.h:283
DetectRunScratchpad::fw_pkt_policy
enum DetectFirewallPacketPolicies fw_pkt_policy
Definition: detect.c:75
flow.h
Signature_::addr_src_match4_cnt
uint16_t addr_src_match4_cnt
Definition: detect.h:708
DetectFirewallPolicy::action_scope
uint8_t action_scope
Definition: detect.h:934
DetectTxFirewallFlowControl
DetectTxFirewallFlowControl
Definition: detect.c:1175
DeStateStoreItem_
Definition: detect-engine-state.h:75
Signature_::addr_dst_match4_cnt
uint16_t addr_dst_match4_cnt
Definition: detect.h:707
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
Packet_::dp
Port dp
Definition: decode.h:531
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectEngineCtx_::sig_array_len
uint32_t sig_array_len
Definition: detect.h:1001
SIG_GROUP_HEAD_HAVEFILESHA256
#define SIG_GROUP_HEAD_HAVEFILESHA256
Definition: detect.h:1554
AlertQueueAppendAppTx
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id, uint8_t sub_state, uint8_t alert_flags)
Append signature to local packet alert queue for later preprocessing.
Definition: detect-engine-alert.c:425
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
Signature_::type
enum SignatureType type
Definition: detect.h:685
StatsCounterAddI64
void StatsCounterAddI64(StatsThreadContext *stats, StatsCounterId id, int64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:145
SigGroupHead_::filestore_cnt
uint16_t filestore_cnt
Definition: detect.h:1699
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1238
DetectFirewallAppPolicy::direction
uint8_t direction
Definition: detect.h:941
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1773
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:234
DetectEngineLookupFlow_::tcp
DetectPort * tcp
Definition: detect.h:878
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
detect-engine-address.h
Flow_::tenant_id
uint32_t tenant_id
Definition: flow.h:424
Packet_::src
Address src
Definition: decode.h:520
SigMatchSignaturesGetSgh
const SigGroupHead * SigMatchSignaturesGetSgh(const DetectEngineCtx *de_ctx, const Packet *p)
Get the SigGroupHead for a packet.
Definition: detect.c:294
DetectRunPrefilterTx
void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t ipproto, const uint8_t flow_flags, const AppProto alproto, void *alstate, DetectTransaction *tx)
run prefilter engines on a transaction
Definition: detect-engine-prefilter.c:95
RuleMatchCandidateTxArrayInit
void RuleMatchCandidateTxArrayInit(DetectEngineThreadCtx *det_ctx, uint32_t size)
Definition: detect.c:1181
APP_LAYER_TX_INSPECTED_TC
#define APP_LAYER_TX_INSPECTED_TC
Definition: app-layer-parser.h:52
SIG_FLAG_DP_ANY
#define SIG_FLAG_DP_ANY
Definition: detect.h:243
DetectPortLookupGroup
DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port)
Function that find the group matching port in a group head.
Definition: detect-engine-port.c:585
DetectEngineThreadCtx_::post_rule_work_queue
PostRuleMatchWorkQueue post_rule_work_queue
Definition: detect.h:1406
PKT_STREAM_EST
#define PKT_STREAM_EST
Definition: decode.h:1307
detect-engine-threshold.h
Signature_::mask
SignatureMask mask
Definition: detect.h:693
AppLayerTxData::updated_ts
bool updated_ts
Definition: app-layer-parser.h:174
app-layer.h
RuleMatchCandidateTx
Definition: detect.h:1254
DetectEngineThreadCtx_::TenantGetId
uint32_t(* TenantGetId)(const void *, const Packet *p)
Definition: detect.h:1317
DetectEngineAppInspectionEngine_::progress
uint8_t progress
Definition: detect.h:426
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:310
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:464
DetectProtoContainsProto
int DetectProtoContainsProto(const DetectProto *dp, int proto)
see if a DetectProto contains a certain proto
Definition: detect-engine-proto.c:115
DetectEngineThreadCtx_::match_array
Signature ** match_array
Definition: detect.h:1391