suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-bs.h"
33 #include "util-mpm-ac-ks.h"
34 #include "util-mpm-hs.h"
35 #include "util-hashlist.h"
36 
37 #include "detect-engine.h"
38 #include "util-misc.h"
39 #include "conf.h"
40 #include "conf-yaml-loader.h"
41 #include "queue.h"
42 #include "util-unittest.h"
43 #include "util-memcpy.h"
44 #ifdef BUILD_HYPERSCAN
45 #include "hs.h"
46 #endif
47 
50 
51 /**
52  * \brief Register a new Mpm Context.
53  *
54  * \param name A new profile to be registered to store this MpmCtx.
55  * \param sm_list sm_list for this name (might be variable with xforms)
56  *
57  * \retval id Return the id created for the new MpmCtx profile.
58  */
60  DetectEngineCtx *de_ctx, const char *name, const int sm_list)
61 {
62  /* the very first entry */
63  if (de_ctx->mpm_ctx_factory_container == NULL) {
65  if (de_ctx->mpm_ctx_factory_container == NULL) {
66  FatalError(SC_ERR_FATAL, "Error allocating memory");
67  }
69  }
70 
72  MpmCtxFactoryItem *pitem = NULL;
73  while (item) {
74  if (item->sm_list == sm_list && item->name != NULL && strcmp(item->name, name) == 0) {
75  return item->id;
76  }
77  pitem = item;
78  item = item->next;
79  }
80 
81  MpmCtxFactoryItem *nitem = SCCalloc(1, sizeof(MpmCtxFactoryItem));
82  if (unlikely(nitem == NULL)) {
83  FatalError(SC_ERR_FATAL, "Error allocating memory");
84  }
85  nitem->name = name;
86  nitem->sm_list = sm_list;
88 
89  /* toserver */
90  nitem->mpm_ctx_ts = SCCalloc(1, sizeof(MpmCtx));
91  if (nitem->mpm_ctx_ts == NULL) {
92  FatalError(SC_ERR_FATAL, "Error allocating memory");
93  }
95 
96  /* toclient */
97  nitem->mpm_ctx_tc = SCCalloc(1, sizeof(MpmCtx));
98  if (nitem->mpm_ctx_tc == NULL) {
99  FatalError(SC_ERR_FATAL, "Error allocating memory");
100  }
102 
103  /* store the newly created item */
104  if (pitem == NULL)
106  else
107  pitem->next = nitem;
108 
110  return nitem->id;
111 }
112 
114 {
115  if (mpm_ctx == NULL)
116  return 0;
117 
118  if (de_ctx->mpm_ctx_factory_container == NULL) {
119  return 0;
120  }
121 
122  for (MpmCtxFactoryItem *i = de_ctx->mpm_ctx_factory_container->items; i != NULL; i = i->next) {
123  if (mpm_ctx == i->mpm_ctx_ts || mpm_ctx == i->mpm_ctx_tc) {
124  return 1;
125  }
126  }
127  return 0;
128 }
129 
130 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
131 {
132  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
133  MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx));
134  if (unlikely(mpm_ctx == NULL)) {
135  FatalError(SC_ERR_FATAL, "Error allocating memory");
136  }
137  memset(mpm_ctx, 0, sizeof(MpmCtx));
138  return mpm_ctx;
139  } else if (id < -1) {
140  SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument - %d\n", id);
141  return NULL;
142  } else if (id >= de_ctx->mpm_ctx_factory_container->max_id) {
143  /* this id does not exist */
144  return NULL;
145  } else {
147  i = i->next) {
148  if (id == i->id) {
149  return (direction == 0) ? i->mpm_ctx_ts : i->mpm_ctx_tc;
150  }
151  }
152  return NULL;
153  }
154 }
155 
157 {
158  if (mpm_ctx == NULL)
159  return;
160 
161  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
162  if (mpm_ctx->mpm_type != MPM_NOTSET)
163  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
164  SCFree(mpm_ctx);
165  }
166 }
167 
169 {
170  if (de_ctx->mpm_ctx_factory_container == NULL)
171  return;
172 
174  while (item) {
175  if (item->mpm_ctx_ts != NULL) {
176  if (item->mpm_ctx_ts->mpm_type != MPM_NOTSET)
178  SCFree(item->mpm_ctx_ts);
179  }
180  if (item->mpm_ctx_tc != NULL) {
181  if (item->mpm_ctx_tc->mpm_type != MPM_NOTSET)
183  SCFree(item->mpm_ctx_tc);
184  }
185 
186  MpmCtxFactoryItem *next = item->next;
187  SCFree(item);
188  item = next;
189  }
190 
193 }
194 
195 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
196 {
197  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
198 }
199 
200 void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher)
201 {
202  mpm_ctx->mpm_type = matcher;
203  mpm_table[matcher].InitCtx(mpm_ctx);
204 }
205 
206 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
207  * If Hyperscan is available, use it. Otherwise, use AC. */
208 #ifdef BUILD_HYPERSCAN
209 # define DEFAULT_MPM MPM_HS
210 # define DEFAULT_MPM_AC MPM_AC
211 #else
212 # define DEFAULT_MPM MPM_AC
213 #endif
214 
215 void MpmTableSetup(void)
216 {
217  memset(mpm_table, 0, sizeof(mpm_table));
219 
220  MpmACRegister();
221  MpmACBSRegister();
223 #ifdef BUILD_HYPERSCAN
224  #ifdef HAVE_HS_VALID_PLATFORM
225  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
226  * check is not successful. */
227  if (hs_valid_platform() != HS_SUCCESS) {
228  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
229  "MPM");
230  /* Fall back to best Aho-Corasick variant. */
231  mpm_default_matcher = DEFAULT_MPM_AC;
232  } else {
233  MpmHSRegister();
234  }
235  #else
236  MpmHSRegister();
237  #endif /* HAVE_HS_VALID_PLATFORM */
238 #endif /* BUILD_HYPERSCAN */
239 }
240 
241 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
242  uint16_t offset, uint16_t depth,
243  uint32_t pid, SigIntId sid, uint8_t flags)
244 {
245  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
246  offset, depth,
247  pid, sid, flags);
248 }
249 
250 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
251  uint16_t offset, uint16_t depth,
252  uint32_t pid, SigIntId sid, uint8_t flags)
253 {
254  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
255  offset, depth,
256  pid, sid, flags);
257 }
258 
259 
260 /**
261  * \internal
262  * \brief Creates a hash of the pattern. We use it for the hashing process
263  * during the initial pattern insertion time, to cull duplicate sigs.
264  *
265  * \param pat Pointer to the pattern.
266  * \param patlen Pattern length.
267  *
268  * \retval hash A 32 bit unsigned hash.
269  */
270 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
271 {
272  uint32_t hash = patlen * pat[0];
273  if (patlen > 1)
274  hash += pat[1];
275 
276  return (hash % MPM_INIT_HASH_SIZE);
277 }
278 
279 /**
280  * \internal
281  * \brief Looks up a pattern. We use it for the hashing process during the
282  * the initial pattern insertion time, to cull duplicate sigs.
283  *
284  * \param ctx Pointer to the AC ctx.
285  * \param pat Pointer to the pattern.
286  * \param patlen Pattern length.
287  * \param flags Flags. We don't need this.
288  *
289  * \retval hash A 32 bit unsigned hash.
290  */
291 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
292  uint8_t *pat, uint16_t patlen,
293  uint16_t offset, uint16_t depth,
294  uint8_t flags, uint32_t pid)
295 {
296  uint32_t hash = MpmInitHashRaw(pat, patlen);
297 
298  if (ctx->init_hash == NULL) {
299  return NULL;
300  }
301 
302  MpmPattern *t = ctx->init_hash[hash];
303  for ( ; t != NULL; t = t->next) {
304  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
305  if (t->id == pid)
306  return t;
307  } else {
308  if (t->len == patlen && t->offset == offset && t->depth == depth &&
309  memcmp(pat, t->original_pat, patlen) == 0 &&
310  t->flags == flags)
311  {
312  return t;
313  }
314  }
315  }
316 
317  return NULL;
318 }
319 
320 /**
321  * \internal
322  * \brief Allocs a new pattern instance.
323  *
324  * \param mpm_ctx Pointer to the mpm context.
325  *
326  * \retval p Pointer to the newly created pattern.
327  */
328 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
329 {
330  MpmPattern *p = SCMalloc(sizeof(MpmPattern));
331  if (unlikely(p == NULL)) {
332  exit(EXIT_FAILURE);
333  }
334  memset(p, 0, sizeof(MpmPattern));
335 
336  mpm_ctx->memory_cnt++;
337  mpm_ctx->memory_size += sizeof(MpmPattern);
338 
339  return p;
340 }
341 
342 /**
343  * \internal
344  * \brief Used to free MpmPattern instances.
345  *
346  * \param mpm_ctx Pointer to the mpm context.
347  * \param p Pointer to the MpmPattern instance to be freed.
348  */
349 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
350 {
351  if (p != NULL && p->cs != NULL && p->cs != p->ci) {
352  SCFree(p->cs);
353  mpm_ctx->memory_cnt--;
354  mpm_ctx->memory_size -= p->len;
355  }
356 
357  if (p != NULL && p->ci != NULL) {
358  SCFree(p->ci);
359  mpm_ctx->memory_cnt--;
360  mpm_ctx->memory_size -= p->len;
361  }
362 
363  if (p != NULL && p->original_pat != NULL) {
364  SCFree(p->original_pat);
365  mpm_ctx->memory_cnt--;
366  mpm_ctx->memory_size -= p->len;
367  }
368 
369  if (p != NULL) {
370  SCFree(p);
371  mpm_ctx->memory_cnt--;
372  mpm_ctx->memory_size -= sizeof(MpmPattern);
373  }
374  return;
375 }
376 
377 static inline uint32_t MpmInitHash(MpmPattern *p)
378 {
379  uint32_t hash = p->len * p->original_pat[0];
380  if (p->len > 1)
381  hash += p->original_pat[1];
382 
383  return (hash % MPM_INIT_HASH_SIZE);
384 }
385 
386 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
387 {
388  uint32_t hash = MpmInitHash(p);
389 
390  if (ctx->init_hash == NULL) {
391  return -1;
392  }
393 
394  if (ctx->init_hash[hash] == NULL) {
395  ctx->init_hash[hash] = p;
396  return 0;
397  }
398 
399  MpmPattern *tt = NULL;
400  MpmPattern *t = ctx->init_hash[hash];
401 
402  /* get the list tail */
403  do {
404  tt = t;
405  t = t->next;
406  } while (t != NULL);
407 
408  tt->next = p;
409 
410  return 0;
411 }
412 
413 /**
414  * \internal
415  * \brief Add a pattern to the mpm-ac context.
416  *
417  * \param mpm_ctx Mpm context.
418  * \param pat Pointer to the pattern.
419  * \param patlen Length of the pattern.
420  * \param pid Pattern id
421  * \param sid Signature id (internal id).
422  * \param flags Pattern's MPM_PATTERN_* flags.
423  *
424  * \retval 0 On success.
425  * \retval -1 On failure.
426  */
427 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
428  uint16_t offset, uint16_t depth, uint32_t pid,
429  SigIntId sid, uint8_t flags)
430 {
431  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
432  mpm_ctx, patlen, pid);
433 
434  if (patlen == 0) {
435  SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0");
436  return 0;
437  }
438 
440  pid = UINT_MAX;
441 
442  /* check if we have already inserted this pattern */
443  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
444  offset, depth, flags, pid);
445  if (p == NULL) {
446  SCLogDebug("Allocing new pattern");
447 
448  /* p will never be NULL */
449  p = MpmAllocPattern(mpm_ctx);
450 
451  p->len = patlen;
452  p->flags = flags;
453  p->offset = offset;
454  p->depth = depth;
456  p->id = mpm_ctx->max_pat_id++;
457  else
458  p->id = pid;
459 
460  p->original_pat = SCMalloc(patlen);
461  if (p->original_pat == NULL)
462  goto error;
463  mpm_ctx->memory_cnt++;
464  mpm_ctx->memory_size += patlen;
465  memcpy(p->original_pat, pat, patlen);
466 
467  p->ci = SCMalloc(patlen);
468  if (p->ci == NULL)
469  goto error;
470  mpm_ctx->memory_cnt++;
471  mpm_ctx->memory_size += patlen;
472  memcpy_tolower(p->ci, pat, patlen);
473 
474  /* setup the case sensitive part of the pattern */
475  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
476  /* nocase means no difference between cs and ci */
477  p->cs = p->ci;
478  } else {
479  if (memcmp(p->ci, pat, p->len) == 0) {
480  /* no diff between cs and ci: pat is lowercase */
481  p->cs = p->ci;
482  } else {
483  p->cs = SCMalloc(patlen);
484  if (p->cs == NULL)
485  goto error;
486  mpm_ctx->memory_cnt++;
487  mpm_ctx->memory_size += patlen;
488  memcpy(p->cs, pat, patlen);
489  }
490  }
491 
492  /* put in the pattern hash */
493  if (MpmInitHashAdd(mpm_ctx, p) != 0)
494  goto error;
495 
496  mpm_ctx->pattern_cnt++;
497 
498  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
499  if (depth) {
500  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
501  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
502  } else {
503  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
504  mpm_ctx->maxdepth = 0;
505  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
506  }
507  }
508 
509  if (mpm_ctx->maxlen < patlen)
510  mpm_ctx->maxlen = patlen;
511 
512  if (mpm_ctx->minlen == 0) {
513  mpm_ctx->minlen = patlen;
514  } else {
515  if (mpm_ctx->minlen > patlen)
516  mpm_ctx->minlen = patlen;
517  }
518 
519  /* we need the max pat id */
520  if (p->id > mpm_ctx->max_pat_id)
521  mpm_ctx->max_pat_id = p->id;
522 
523  p->sids_size = 1;
524  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
525  BUG_ON(p->sids == NULL);
526  p->sids[0] = sid;
527  } else {
528  /* we can be called multiple times for the same sid in the case
529  * of the 'single' modus. Here multiple rule groups share the
530  * same mpm ctx and might be adding the same pattern to the
531  * mpm_ctx */
532  int found = 0;
533  uint32_t x = 0;
534  for (x = 0; x < p->sids_size; x++) {
535  if (p->sids[x] == sid) {
536  found = 1;
537  break;
538  }
539  }
540 
541  if (!found) {
542  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
543  BUG_ON(sids == NULL);
544  p->sids = sids;
545  p->sids[p->sids_size] = sid;
546  p->sids_size++;
547  }
548  }
549 
550  return 0;
551 
552 error:
553  MpmFreePattern(mpm_ctx, p);
554  return -1;
555 }
556 
557 
558 /************************************Unittests*********************************/
559 
560 #ifdef UNITTESTS
561 #endif /* UNITTESTS */
562 
564 {
565 #ifdef UNITTESTS
566  uint16_t i;
567 
568  for (i = 0; i < MPM_TABLE_SIZE; i++) {
569  if (i == MPM_NOTSET)
570  continue;
571 
572  g_ut_modules++;
573 
574  if (mpm_table[i].RegisterUnittests != NULL) {
575  g_ut_covered++;
577  } else {
578  if (coverage_unittests)
579  SCLogWarning(SC_WARN_NO_UNITTESTS, "mpm module %s has no "
580  "unittest registration function.", mpm_table[i].name);
581  }
582  }
583 
584 #endif
585 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:195
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:147
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:168
g_ut_modules
int g_ut_modules
Definition: suricata.c:833
MpmThreadCtx_
Definition: util-mpm.h:46
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:349
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:156
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
util-mpm-ac-ks.h
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:200
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:563
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:758
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:103
g_ut_covered
int g_ut_covered
Definition: suricata.c:834
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:163
MpmCtxFactoryItem::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:162
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:828
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:32
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:94
MAX
#define MAX(x, y)
Definition: suricata-common.h:372
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:146
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:212
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:105
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list)
Register a new Mpm Context.
Definition: util-mpm.c:59
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem::name
const char * name
Definition: util-mpm.h:116
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:113
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:130
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:142
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:125
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:277
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:29
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:54
MpmCtxFactoryItem::sm_list
int32_t sm_list
Definition: util-mpm.h:120
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:215
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:241
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:86
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1457
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
#define ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
Definition: detect.h:965
MpmCtxFactoryItem::next
struct MpmCtxFactoryItem * next
Definition: util-mpm.h:121
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:131
MpmACBSRegister
void MpmACBSRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac-bs.c:95
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
util-mpm-ac-bs.h
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:148
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
MpmCtxFactoryItem
Definition: util-mpm.h:115
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1229
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:126
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
mpm_default_matcher
int mpm_default_matcher
Definition: util-mpm.c:49
MpmCtxFactoryItem::id
int32_t id
Definition: util-mpm.h:119
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:102
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:108
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
MpmCtxFactoryItem::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:427
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:127
coverage_unittests
int coverage_unittests
Definition: suricata.c:832
MpmCtx_
Definition: util-mpm.h:88
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:292
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
MpmTableElmt_
Definition: util-mpm.h:144
MpmHSRegister
void MpmHSRegister(void)
SC_WARN_NO_UNITTESTS
@ SC_WARN_NO_UNITTESTS
Definition: util-error.h:266
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:250
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:168
MpmCtxFactoryContainer_
Definition: util-mpm.h:124