suricata
util-mpm-ac-bs.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  *
23  */
24 
25 #include "util-mpm.h"
26 
27 #define SC_AC_BS_STATE_TYPE_U16 uint16_t
28 #define SC_AC_BS_STATE_TYPE_U32 uint32_t
29 
30 typedef struct SCACBSPatternList_ {
31  uint8_t *cs;
32  uint16_t patlen;
33 
34  /* sid(s) for this pattern */
35  uint32_t sids_size;
38 
39 typedef struct SCACBSOutputTable_ {
40  /* list of pattern sids */
41  uint32_t *pids;
42  /* no of entries we have in pids */
43  uint32_t no_of_entries;
45 
46 typedef struct SCACBSCtx_ {
47  /* pattern arrays. We need this only during the goto table creation phase */
49 
50  /* no of states used by ac */
51  uint32_t state_count;
52 
54 
55  /* the all important memory hungry state_table */
56  SC_AC_BS_STATE_TYPE_U16 (*state_table_u16)[256];
57  /* the all important memory hungry state_table */
58  SC_AC_BS_STATE_TYPE_U32 (*state_table_u32)[256];
59  /* the modified goto_table */
60  uint8_t *state_table_mod;
62 
63  /* goto_table, failure table and output table. Needed to create state_table.
64  * Will be freed, once we have created the state_table */
65  int32_t (*goto_table)[256];
66  int32_t *failure_table;
69 
70  /* the size of each state */
72 } SCACBSCtx;
73 
74 typedef struct SCACBSThreadCtx_ {
75  /* the total calls we make to the search function */
76  uint32_t total_calls;
77  /* the total patterns that we ended up matching against */
78  uint64_t total_matches;
80 
81 void MpmACBSRegister(void);
MpmPattern ** parray
uint64_t total_matches
uint16_t single_state_size
struct SCACBSOutputTable_ SCACBSOutputTable
uint8_t ** state_table_mod_pointers
struct SCACBSCtx_ SCACBSCtx
#define SC_AC_BS_STATE_TYPE_U32
int32_t * failure_table
uint32_t state_count
SCACBSPatternList * pid_pat_list
struct SCACBSThreadCtx_ SCACBSThreadCtx
SCACBSOutputTable * output_table
void MpmACBSRegister(void)
Register the aho-corasick mpm.
#define SC_AC_BS_STATE_TYPE_U16
struct SCACBSPatternList_ SCACBSPatternList
#define SigIntId
uint32_t total_calls
uint32_t pattern_id_bitarray_size
uint8_t * state_table_mod