suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-build.h"
#include "conf.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-memcmp.h"
#include "util-memcpy.h"
#include "util-validate.h"
#include "util-mpm-ac-ks.h"
#include "util-mpm-ac-ks-small.c"
#include "detect-engine-alert.h"
Go to the source code of this file.
Data Structures | |
struct | StateQueue_ |
Helper structure used by AC during state table creation. More... | |
Macros | |
#define | SC_AC_TILE_FAIL (-1) |
#define | STATE_QUEUE_CONTAINER_SIZE 65536 |
#define | SCHECK(x) ((x) > 0) |
#define | BUF_TYPE int32_t |
#define | BYTE0(x) (((x) & 0x000000ff) >> 0) |
#define | BYTE1(x) (((x) & 0x0000ff00) >> 8) |
#define | BYTE2(x) (((x) & 0x00ff0000) >> 16) |
#define | BYTE3(x) (((x) & 0xff000000) >> 24) |
#define | EXTRA 4 |
#define | SINDEX_INTERNAL(y, x, log_mult, width) ((1<<log_mult) * (x & ((1<<width) - 1))) |
#define | STYPE int16_t |
#define | SLOAD(x) *(STYPE * restrict)(x) |
#define | FUNC_NAME SCACTileSearchSmall256 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 8, 15) |
#define | FUNC_NAME SCACTileSearchSmall128 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 7, 15) |
#define | FUNC_NAME SCACTileSearchSmall64 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 6, 15) |
#define | FUNC_NAME SCACTileSearchSmall32 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 5, 15) |
#define | FUNC_NAME SCACTileSearchSmall16 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 4, 15) |
#define | FUNC_NAME SCACTileSearchSmall8 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 3, 15) |
#define | STYPE int8_t |
#define | FUNC_NAME SCACTileSearchTiny256 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 8, 7) |
#define | FUNC_NAME SCACTileSearchTiny128 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 7, 7) |
#define | FUNC_NAME SCACTileSearchTiny64 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 6, 7) |
#define | FUNC_NAME SCACTileSearchTiny32 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 5, 7) |
#define | FUNC_NAME SCACTileSearchTiny16 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 4, 7) |
#define | FUNC_NAME SCACTileSearchTiny8 |
#define | SINDEX(y, x) SINDEX_INTERNAL(y, x, 3, 7) |
Typedefs | |
typedef struct StateQueue_ | StateQueue |
Helper structure used by AC during state table creation. More... | |
Functions | |
void | SCACTileInitCtx (MpmCtx *mpm_ctx) |
Initialize the AC context. More... | |
void | SCACTileDestroyCtx (MpmCtx *mpm_ctx) |
Destroy the mpm context. More... | |
int | SCACTileAddPatternCI (MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) |
Add a case insensitive pattern. Although we have different calls for adding case sensitive and insensitive patterns, we make a single call for either case. No special treatment for either case. More... | |
int | SCACTileAddPatternCS (MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) |
Add a case sensitive pattern. Although we have different calls for adding case sensitive and insensitive patterns, we make a single call for either case. No special treatment for either case. More... | |
int | SCACTilePreparePatterns (MpmCtx *mpm_ctx) |
Process the patterns added to the mpm, and create the internal tables. More... | |
uint32_t | SCACTileSearch (const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
The aho corasick search function. More... | |
void | SCACTilePrintInfo (MpmCtx *mpm_ctx) |
uint32_t | SCACTileSearchLarge (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall256 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall128 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall64 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall32 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall16 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchSmall8 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny256 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny128 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny64 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny32 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny16 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
uint32_t | SCACTileSearchTiny8 (const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen) |
void | MpmACTileRegister (void) |
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor. More... | |
Definition in file util-mpm-ac-ks.c.
#define BUF_TYPE int32_t |
Definition at line 1109 of file util-mpm-ac-ks.c.
#define BYTE0 | ( | x | ) | (((x) & 0x000000ff) >> 0) |
Definition at line 1111 of file util-mpm-ac-ks.c.
#define BYTE1 | ( | x | ) | (((x) & 0x0000ff00) >> 8) |
Definition at line 1112 of file util-mpm-ac-ks.c.
#define BYTE2 | ( | x | ) | (((x) & 0x00ff0000) >> 16) |
Definition at line 1113 of file util-mpm-ac-ks.c.
#define BYTE3 | ( | x | ) | (((x) & 0xff000000) >> 24) |
Definition at line 1114 of file util-mpm-ac-ks.c.
#define EXTRA 4 |
Definition at line 1115 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall256 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall128 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall64 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall32 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall16 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchSmall8 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny256 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny128 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny64 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny32 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny16 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define FUNC_NAME SCACTileSearchTiny8 |
Definition at line 1316 of file util-mpm-ac-ks.c.
#define SC_AC_TILE_FAIL (-1) |
Definition at line 149 of file util-mpm-ac-ks.c.
#define SCHECK | ( | x | ) | ((x) > 0) |
Definition at line 1108 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 8, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 7, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 6, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 5, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 4, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 3, 15) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 8, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 7, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 6, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 5, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 4, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX | ( | y, | |
x | |||
) | SINDEX_INTERNAL(y, x, 3, 7) |
Definition at line 1318 of file util-mpm-ac-ks.c.
#define SINDEX_INTERNAL | ( | y, | |
x, | |||
log_mult, | |||
width | |||
) | ((1<<log_mult) * (x & ((1<<width) - 1))) |
Definition at line 1215 of file util-mpm-ac-ks.c.
#define SLOAD | ( | x | ) | *(STYPE * restrict)(x) |
Definition at line 1220 of file util-mpm-ac-ks.c.
#define STATE_QUEUE_CONTAINER_SIZE 65536 |
Definition at line 151 of file util-mpm-ac-ks.c.
#define STYPE int16_t |
Definition at line 1272 of file util-mpm-ac-ks.c.
#define STYPE int8_t |
Definition at line 1272 of file util-mpm-ac-ks.c.
typedef struct StateQueue_ StateQueue |
Helper structure used by AC during state table creation.
void MpmACTileRegister | ( | void | ) |
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition at line 1398 of file util-mpm-ac-ks.c.
References MpmTableElmt_::AddPattern, MpmTableElmt_::AddPatternNocase, MpmTableElmt_::DestroyCtx, MpmTableElmt_::InitCtx, MPM_AC_KS, mpm_table, MpmTableElmt_::name, MpmTableElmt_::Prepare, MpmTableElmt_::PrintCtx, MpmTableElmt_::RegisterUnittests, SCACTileAddPatternCI(), SCACTileAddPatternCS(), SCACTileDestroyCtx(), SCACTileInitCtx(), SCACTilePreparePatterns(), SCACTilePrintInfo(), SCACTileSearch(), and MpmTableElmt_::Search.
Referenced by MpmTableSetup().
int SCACTileAddPatternCI | ( | MpmCtx * | mpm_ctx, |
uint8_t * | pat, | ||
uint16_t | patlen, | ||
uint16_t | offset, | ||
uint16_t | depth, | ||
uint32_t | pid, | ||
SigIntId | sid, | ||
uint8_t | flags | ||
) |
Add a case insensitive pattern. Although we have different calls for adding case sensitive and insensitive patterns, we make a single call for either case. No special treatment for either case.
mpm_ctx | Pointer to the mpm context. |
pat | The pattern to add. |
patnen | The pattern length. |
offset | Ignored. |
depth | Ignored. |
pid | The pattern id. |
sid | Ignored. |
flags | Flags associated with this pattern. |
0 | On success. |
-1 | On failure. |
Definition at line 1338 of file util-mpm-ac-ks.c.
References flags, MPM_PATTERN_FLAG_NOCASE, MpmAddPattern(), and offset.
Referenced by MpmACTileRegister().
int SCACTileAddPatternCS | ( | MpmCtx * | mpm_ctx, |
uint8_t * | pat, | ||
uint16_t | patlen, | ||
uint16_t | offset, | ||
uint16_t | depth, | ||
uint32_t | pid, | ||
SigIntId | sid, | ||
uint8_t | flags | ||
) |
Add a case sensitive pattern. Although we have different calls for adding case sensitive and insensitive patterns, we make a single call for either case. No special treatment for either case.
mpm_ctx | Pointer to the mpm context. |
pat | The pattern to add. |
patnen | The pattern length. |
offset | Ignored. |
depth | Ignored. |
pid | The pattern id. |
sid | Ignored. |
flags | Flags associated with this pattern. |
0 | On success. |
-1 | On failure. |
Definition at line 1364 of file util-mpm-ac-ks.c.
References flags, MpmAddPattern(), and offset.
Referenced by MpmACTileRegister().
void SCACTileDestroyCtx | ( | MpmCtx * | mpm_ctx | ) |
Destroy the mpm context.
mpm_ctx | Pointer to the mpm context. |
Definition at line 1065 of file util-mpm-ac-ks.c.
References MpmCtx_::ctx.
Referenced by MpmACTileRegister().
void SCACTileInitCtx | ( | MpmCtx * | mpm_ctx | ) |
Initialize the AC context.
mpm_ctx | Mpm context. |
Definition at line 964 of file util-mpm-ac-ks.c.
References MpmCtx_::ctx, SCACTileSearchCtx_::init_ctx, MpmCtx_::init_hash, MpmCtx_::memory_cnt, MpmCtx_::memory_size, MPM_INIT_HASH_SIZE, and SCCalloc.
Referenced by MpmACTileRegister().
int SCACTilePreparePatterns | ( | MpmCtx * | mpm_ctx | ) |
Process the patterns added to the mpm, and create the internal tables.
mpm_ctx | Pointer to the mpm context. |
Definition at line 864 of file util-mpm-ac-ks.c.
References ctx, MpmCtx_::ctx, SCACTileSearchCtx_::init_ctx, MpmCtx_::init_hash, MPM_INIT_HASH_SIZE, MpmPattern_::next, MpmCtx_::pattern_cnt, SCCalloc, and SCLogDebug.
Referenced by MpmACTileRegister().
void SCACTilePrintInfo | ( | MpmCtx * | mpm_ctx | ) |
Definition at line 1372 of file util-mpm-ac-ks.c.
References ctx, MpmCtx_::ctx, SCACTileSearchCtx_::init_ctx, MpmCtx_::maxlen, MpmCtx_::memory_cnt, MpmCtx_::memory_size, MpmCtx_::minlen, and MpmCtx_::pattern_cnt.
Referenced by MpmACTileRegister().
uint32_t SCACTileSearch | ( | const MpmCtx * | mpm_ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
The aho corasick search function.
mpm_ctx | Pointer to the mpm context. |
mpm_thread_ctx | Pointer to the mpm thread context. |
pmq | Pointer to the Pattern Matcher Queue to hold search matches. |
buf | Buffer to be searched. |
buflen | Buffer length. |
matches | Match count. |
Definition at line 1172 of file util-mpm-ac-ks.c.
References MpmCtx_::ctx, and SCACTileSearchCtx_::Search.
Referenced by MpmACTileRegister().
uint32_t SCACTileSearchLarge | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
Definition at line 1185 of file util-mpm-ac-ks.c.
References ctx, DEBUG_VALIDATE_BUG_ON, and SCHECK.
uint32_t SCACTileSearchSmall128 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchSmall16 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchSmall256 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchSmall32 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchSmall64 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchSmall8 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny128 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny16 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny256 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny32 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny64 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |
uint32_t SCACTileSearchTiny8 | ( | const SCACTileSearchCtx * | ctx, |
MpmThreadCtx * | mpm_thread_ctx, | ||
PrefilterRuleStore * | pmq, | ||
const uint8_t * | buf, | ||
uint32_t | buflen | ||
) |