suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-bs.h"
33 #include "util-mpm-ac-ks.h"
34 #include "util-mpm-hs.h"
35 #include "util-hashlist.h"
36 
37 #include "detect-engine.h"
38 #include "util-misc.h"
39 #include "conf.h"
40 #include "conf-yaml-loader.h"
41 #include "queue.h"
42 #include "util-unittest.h"
43 #include "util-memcpy.h"
44 #ifdef BUILD_HYPERSCAN
45 #include "hs.h"
46 #endif
47 
50 
51 /**
52  * \brief Register a new Mpm Context.
53  *
54  * \param name A new profile to be registered to store this MpmCtx.
55  * \param sm_list sm_list for this name (might be variable with xforms)
56  *
57  * \retval id Return the id created for the new MpmCtx profile.
58  */
60  DetectEngineCtx *de_ctx, const char *name, const int sm_list)
61 {
62  void *ptmp;
63  /* the very first entry */
64  if (de_ctx->mpm_ctx_factory_container == NULL) {
66  if (de_ctx->mpm_ctx_factory_container == NULL) {
67  FatalError(SC_ERR_FATAL, "Error allocating memory");
68  }
71 
73  if (unlikely(item == NULL)) {
74  FatalError(SC_ERR_FATAL, "Error allocating memory");
75  }
76 
77  item[0].name = name;
78  item[0].sm_list = sm_list;
79 
80  /* toserver */
81  item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
82  if (item[0].mpm_ctx_ts == NULL) {
83  FatalError(SC_ERR_FATAL, "Error allocating memory");
84  }
85  memset(item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
87 
88  /* toclient */
89  item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
90  if (item[0].mpm_ctx_tc == NULL) {
91  FatalError(SC_ERR_FATAL, "Error allocating memory");
92  }
93  memset(item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
96 
97  /* store the newly created item */
100 
101  /* the first id is always 0 */
102  return item[0].id;
103  } else {
104  int i;
106  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
107  if (items[i].sm_list == sm_list && items[i].name != NULL &&
108  strcmp(items[i].name, name) == 0) {
109  /* looks like we have this mpm_ctx freed */
110  if (items[i].mpm_ctx_ts == NULL) {
111  items[i].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
112  if (items[i].mpm_ctx_ts == NULL) {
113  FatalError(SC_ERR_FATAL, "Error allocating memory");
114  }
115  memset(items[i].mpm_ctx_ts, 0, sizeof(MpmCtx));
116  items[i].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
117  }
118  if (items[i].mpm_ctx_tc == NULL) {
119  items[i].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
120  if (items[i].mpm_ctx_tc == NULL) {
121  FatalError(SC_ERR_FATAL, "Error allocating memory");
122  }
123  memset(items[i].mpm_ctx_tc, 0, sizeof(MpmCtx));
124  items[i].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
125  }
126  return items[i].id;
127  }
128  }
129 
130  /* let's make the new entry */
131  ptmp = SCRealloc(items,
133  if (unlikely(ptmp == NULL)) {
134  SCFree(items);
135  items = NULL;
136  FatalError(SC_ERR_FATAL, "Error allocating memory");
137  }
138  items = ptmp;
139 
141 
143  new_item[0].name = name;
144  new_item[0].sm_list = sm_list;
145 
146  /* toserver */
147  new_item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
148  if (new_item[0].mpm_ctx_ts == NULL) {
149  FatalError(SC_ERR_FATAL, "Error allocating memory");
150  }
151  memset(new_item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
152  new_item[0].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
153 
154  /* toclient */
155  new_item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
156  if (new_item[0].mpm_ctx_tc == NULL) {
157  FatalError(SC_ERR_FATAL, "Error allocating memory");
158  }
159  memset(new_item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
160  new_item[0].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
161 
162  new_item[0].id = de_ctx->mpm_ctx_factory_container->max_id++;
164 
165  /* the newly created id */
166  return new_item[0].id;
167  }
168 }
169 
171 {
172  if (mpm_ctx == NULL)
173  return 0;
174 
175  if (de_ctx->mpm_ctx_factory_container == NULL) {
176  return 0;
177  } else {
178  int i;
179  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
180  if (mpm_ctx == de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_ts ||
182  return 1;
183  }
184  }
185  return 0;
186  }
187 }
188 
189 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
190 {
191  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
192  MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx));
193  if (unlikely(mpm_ctx == NULL)) {
194  FatalError(SC_ERR_FATAL, "Error allocating memory");
195  }
196  memset(mpm_ctx, 0, sizeof(MpmCtx));
197  return mpm_ctx;
198  } else if (id < -1) {
199  SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument - %d\n", id);
200  return NULL;
201  } else if (id >= de_ctx->mpm_ctx_factory_container->max_id) {
202  /* this id does not exist */
203  return NULL;
204  } else {
205  for (int i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
206  if (id == de_ctx->mpm_ctx_factory_container->items[i].id) {
207  return (direction == 0) ? de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_ts
209  }
210  }
211  return NULL;
212  }
213 }
214 
216 {
217  if (mpm_ctx == NULL)
218  return;
219 
220  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
221  if (mpm_ctx->mpm_type != MPM_NOTSET)
222  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
223  SCFree(mpm_ctx);
224  }
225 
226  return;
227 }
228 
230 {
231  if (de_ctx->mpm_ctx_factory_container == NULL)
232  return;
233 
234  int i = 0;
236  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
237  if (items[i].mpm_ctx_ts != NULL) {
238  if (items[i].mpm_ctx_ts->mpm_type != MPM_NOTSET)
239  mpm_table[items[i].mpm_ctx_ts->mpm_type].DestroyCtx(items[i].mpm_ctx_ts);
240  SCFree(items[i].mpm_ctx_ts);
241  }
242  if (items[i].mpm_ctx_tc != NULL) {
243  if (items[i].mpm_ctx_tc->mpm_type != MPM_NOTSET)
244  mpm_table[items[i].mpm_ctx_tc->mpm_type].DestroyCtx(items[i].mpm_ctx_tc);
245  SCFree(items[i].mpm_ctx_tc);
246  }
247  }
248 
252 
253  return;
254 }
255 
256 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
257 {
258  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
259 }
260 
261 void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher)
262 {
263  mpm_ctx->mpm_type = matcher;
264  mpm_table[matcher].InitCtx(mpm_ctx);
265 }
266 
267 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
268  * If Hyperscan is available, use it. Otherwise, use AC. */
269 #ifdef BUILD_HYPERSCAN
270 # define DEFAULT_MPM MPM_HS
271 # define DEFAULT_MPM_AC MPM_AC
272 #else
273 # define DEFAULT_MPM MPM_AC
274 #endif
275 
276 void MpmTableSetup(void)
277 {
278  memset(mpm_table, 0, sizeof(mpm_table));
280 
281  MpmACRegister();
282  MpmACBSRegister();
284 #ifdef BUILD_HYPERSCAN
285  #ifdef HAVE_HS_VALID_PLATFORM
286  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
287  * check is not successful. */
288  if (hs_valid_platform() != HS_SUCCESS) {
289  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
290  "MPM");
291  /* Fall back to best Aho-Corasick variant. */
292  mpm_default_matcher = DEFAULT_MPM_AC;
293  } else {
294  MpmHSRegister();
295  }
296  #else
297  MpmHSRegister();
298  #endif /* HAVE_HS_VALID_PLATFORM */
299 #endif /* BUILD_HYPERSCAN */
300 }
301 
302 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
303  uint16_t offset, uint16_t depth,
304  uint32_t pid, SigIntId sid, uint8_t flags)
305 {
306  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
307  offset, depth,
308  pid, sid, flags);
309 }
310 
311 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
312  uint16_t offset, uint16_t depth,
313  uint32_t pid, SigIntId sid, uint8_t flags)
314 {
315  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
316  offset, depth,
317  pid, sid, flags);
318 }
319 
320 
321 /**
322  * \internal
323  * \brief Creates a hash of the pattern. We use it for the hashing process
324  * during the initial pattern insertion time, to cull duplicate sigs.
325  *
326  * \param pat Pointer to the pattern.
327  * \param patlen Pattern length.
328  *
329  * \retval hash A 32 bit unsigned hash.
330  */
331 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
332 {
333  uint32_t hash = patlen * pat[0];
334  if (patlen > 1)
335  hash += pat[1];
336 
337  return (hash % MPM_INIT_HASH_SIZE);
338 }
339 
340 /**
341  * \internal
342  * \brief Looks up a pattern. We use it for the hashing process during the
343  * the initial pattern insertion time, to cull duplicate sigs.
344  *
345  * \param ctx Pointer to the AC ctx.
346  * \param pat Pointer to the pattern.
347  * \param patlen Pattern length.
348  * \param flags Flags. We don't need this.
349  *
350  * \retval hash A 32 bit unsigned hash.
351  */
352 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
353  uint8_t *pat, uint16_t patlen,
354  uint16_t offset, uint16_t depth,
355  uint8_t flags, uint32_t pid)
356 {
357  uint32_t hash = MpmInitHashRaw(pat, patlen);
358 
359  if (ctx->init_hash == NULL) {
360  return NULL;
361  }
362 
363  MpmPattern *t = ctx->init_hash[hash];
364  for ( ; t != NULL; t = t->next) {
365  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
366  if (t->id == pid)
367  return t;
368  } else {
369  if (t->len == patlen && t->offset == offset && t->depth == depth &&
370  memcmp(pat, t->original_pat, patlen) == 0 &&
371  t->flags == flags)
372  {
373  return t;
374  }
375  }
376  }
377 
378  return NULL;
379 }
380 
381 /**
382  * \internal
383  * \brief Allocs a new pattern instance.
384  *
385  * \param mpm_ctx Pointer to the mpm context.
386  *
387  * \retval p Pointer to the newly created pattern.
388  */
389 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
390 {
391  MpmPattern *p = SCMalloc(sizeof(MpmPattern));
392  if (unlikely(p == NULL)) {
393  exit(EXIT_FAILURE);
394  }
395  memset(p, 0, sizeof(MpmPattern));
396 
397  mpm_ctx->memory_cnt++;
398  mpm_ctx->memory_size += sizeof(MpmPattern);
399 
400  return p;
401 }
402 
403 /**
404  * \internal
405  * \brief Used to free MpmPattern instances.
406  *
407  * \param mpm_ctx Pointer to the mpm context.
408  * \param p Pointer to the MpmPattern instance to be freed.
409  */
410 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
411 {
412  if (p != NULL && p->cs != NULL && p->cs != p->ci) {
413  SCFree(p->cs);
414  mpm_ctx->memory_cnt--;
415  mpm_ctx->memory_size -= p->len;
416  }
417 
418  if (p != NULL && p->ci != NULL) {
419  SCFree(p->ci);
420  mpm_ctx->memory_cnt--;
421  mpm_ctx->memory_size -= p->len;
422  }
423 
424  if (p != NULL && p->original_pat != NULL) {
425  SCFree(p->original_pat);
426  mpm_ctx->memory_cnt--;
427  mpm_ctx->memory_size -= p->len;
428  }
429 
430  if (p != NULL) {
431  SCFree(p);
432  mpm_ctx->memory_cnt--;
433  mpm_ctx->memory_size -= sizeof(MpmPattern);
434  }
435  return;
436 }
437 
438 static inline uint32_t MpmInitHash(MpmPattern *p)
439 {
440  uint32_t hash = p->len * p->original_pat[0];
441  if (p->len > 1)
442  hash += p->original_pat[1];
443 
444  return (hash % MPM_INIT_HASH_SIZE);
445 }
446 
447 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
448 {
449  uint32_t hash = MpmInitHash(p);
450 
451  if (ctx->init_hash == NULL) {
452  return -1;
453  }
454 
455  if (ctx->init_hash[hash] == NULL) {
456  ctx->init_hash[hash] = p;
457  return 0;
458  }
459 
460  MpmPattern *tt = NULL;
461  MpmPattern *t = ctx->init_hash[hash];
462 
463  /* get the list tail */
464  do {
465  tt = t;
466  t = t->next;
467  } while (t != NULL);
468 
469  tt->next = p;
470 
471  return 0;
472 }
473 
474 /**
475  * \internal
476  * \brief Add a pattern to the mpm-ac context.
477  *
478  * \param mpm_ctx Mpm context.
479  * \param pat Pointer to the pattern.
480  * \param patlen Length of the pattern.
481  * \param pid Pattern id
482  * \param sid Signature id (internal id).
483  * \param flags Pattern's MPM_PATTERN_* flags.
484  *
485  * \retval 0 On success.
486  * \retval -1 On failure.
487  */
488 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
489  uint16_t offset, uint16_t depth, uint32_t pid,
490  SigIntId sid, uint8_t flags)
491 {
492  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
493  mpm_ctx, patlen, pid);
494 
495  if (patlen == 0) {
496  SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0");
497  return 0;
498  }
499 
501  pid = UINT_MAX;
502 
503  /* check if we have already inserted this pattern */
504  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
505  offset, depth, flags, pid);
506  if (p == NULL) {
507  SCLogDebug("Allocing new pattern");
508 
509  /* p will never be NULL */
510  p = MpmAllocPattern(mpm_ctx);
511 
512  p->len = patlen;
513  p->flags = flags;
514  p->offset = offset;
515  p->depth = depth;
517  p->id = mpm_ctx->max_pat_id++;
518  else
519  p->id = pid;
520 
521  p->original_pat = SCMalloc(patlen);
522  if (p->original_pat == NULL)
523  goto error;
524  mpm_ctx->memory_cnt++;
525  mpm_ctx->memory_size += patlen;
526  memcpy(p->original_pat, pat, patlen);
527 
528  p->ci = SCMalloc(patlen);
529  if (p->ci == NULL)
530  goto error;
531  mpm_ctx->memory_cnt++;
532  mpm_ctx->memory_size += patlen;
533  memcpy_tolower(p->ci, pat, patlen);
534 
535  /* setup the case sensitive part of the pattern */
536  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
537  /* nocase means no difference between cs and ci */
538  p->cs = p->ci;
539  } else {
540  if (memcmp(p->ci, pat, p->len) == 0) {
541  /* no diff between cs and ci: pat is lowercase */
542  p->cs = p->ci;
543  } else {
544  p->cs = SCMalloc(patlen);
545  if (p->cs == NULL)
546  goto error;
547  mpm_ctx->memory_cnt++;
548  mpm_ctx->memory_size += patlen;
549  memcpy(p->cs, pat, patlen);
550  }
551  }
552 
553  /* put in the pattern hash */
554  if (MpmInitHashAdd(mpm_ctx, p) != 0)
555  goto error;
556 
557  mpm_ctx->pattern_cnt++;
558 
559  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
560  if (depth) {
561  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
562  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
563  } else {
564  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
565  mpm_ctx->maxdepth = 0;
566  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
567  }
568  }
569 
570  if (mpm_ctx->maxlen < patlen)
571  mpm_ctx->maxlen = patlen;
572 
573  if (mpm_ctx->minlen == 0) {
574  mpm_ctx->minlen = patlen;
575  } else {
576  if (mpm_ctx->minlen > patlen)
577  mpm_ctx->minlen = patlen;
578  }
579 
580  /* we need the max pat id */
581  if (p->id > mpm_ctx->max_pat_id)
582  mpm_ctx->max_pat_id = p->id;
583 
584  p->sids_size = 1;
585  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
586  BUG_ON(p->sids == NULL);
587  p->sids[0] = sid;
588  } else {
589  /* we can be called multiple times for the same sid in the case
590  * of the 'single' modus. Here multiple rule groups share the
591  * same mpm ctx and might be adding the same pattern to the
592  * mpm_ctx */
593  int found = 0;
594  uint32_t x = 0;
595  for (x = 0; x < p->sids_size; x++) {
596  if (p->sids[x] == sid) {
597  found = 1;
598  break;
599  }
600  }
601 
602  if (!found) {
603  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
604  BUG_ON(sids == NULL);
605  p->sids = sids;
606  p->sids[p->sids_size] = sid;
607  p->sids_size++;
608  }
609  }
610 
611  return 0;
612 
613 error:
614  MpmFreePattern(mpm_ctx, p);
615  return -1;
616 }
617 
618 
619 /************************************Unittests*********************************/
620 
621 #ifdef UNITTESTS
622 #endif /* UNITTESTS */
623 
625 {
626 #ifdef UNITTESTS
627  uint16_t i;
628 
629  for (i = 0; i < MPM_TABLE_SIZE; i++) {
630  if (i == MPM_NOTSET)
631  continue;
632 
633  g_ut_modules++;
634 
635  if (mpm_table[i].RegisterUnittests != NULL) {
636  g_ut_covered++;
638  } else {
639  if (coverage_unittests)
640  SCLogWarning(SC_WARN_NO_UNITTESTS, "mpm module %s has no "
641  "unittest registration function.", mpm_table[i].name);
642  }
643  }
644 
645 #endif
646 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:256
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
MpmCtxFactoryItem_::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:146
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:229
g_ut_modules
int g_ut_modules
Definition: suricata.c:830
MpmThreadCtx_
Definition: util-mpm.h:46
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:410
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:215
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
util-mpm-ac-ks.h
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:261
MpmCtxFactoryItem_::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:624
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:757
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:103
g_ut_covered
int g_ut_covered
Definition: suricata.c:831
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:162
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:161
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:826
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:32
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:94
MAX
#define MAX(x, y)
Definition: suricata-common.h:376
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:145
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
MpmCtxFactoryItem_::name
const char * name
Definition: util-mpm.h:116
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:273
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:105
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list)
Register a new Mpm Context.
Definition: util-mpm.c:59
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem_::id
int32_t id
Definition: util-mpm.h:119
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:170
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:189
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:141
MpmCtxFactoryItem_::sm_list
int32_t sm_list
Definition: util-mpm.h:120
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:124
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:277
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:29
MpmCtxFactoryItem_
Definition: util-mpm.h:115
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:54
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:276
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:302
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:86
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1457
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
#define ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
Definition: detect.h:963
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:130
MpmACBSRegister
void MpmACBSRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac-bs.c:95
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
util-mpm-ac-bs.h
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:147
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1229
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:125
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
mpm_default_matcher
int mpm_default_matcher
Definition: util-mpm.c:49
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:102
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:108
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:488
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:126
coverage_unittests
int coverage_unittests
Definition: suricata.c:829
MpmCtx_
Definition: util-mpm.h:88
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:292
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
MpmTableElmt_
Definition: util-mpm.h:143
MpmHSRegister
void MpmHSRegister(void)
SC_WARN_NO_UNITTESTS
@ SC_WARN_NO_UNITTESTS
Definition: util-error.h:266
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:311
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:167
MpmCtxFactoryContainer_
Definition: util-mpm.h:123