suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-ks.h"
33 #include "util-mpm-hs.h"
34 #include "util-hashlist.h"
35 
36 #include "detect-engine.h"
37 #include "util-misc.h"
38 #include "conf.h"
39 #include "conf-yaml-loader.h"
40 #include "queue.h"
41 #include "util-unittest.h"
42 #include "util-memcpy.h"
43 #ifdef BUILD_HYPERSCAN
44 #include "hs.h"
45 #endif
46 
49 
50 /**
51  * \brief Register a new Mpm Context.
52  *
53  * \param name A new profile to be registered to store this MpmCtx.
54  * \param sm_list sm_list for this name (might be variable with xforms)
55  * \param alproto app proto or ALPROTO_UNKNOWN if not for app-layer
56  *
57  * \retval id Return the id created for the new MpmCtx profile.
58  */
60  DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
61 {
62  /* the very first entry */
63  if (de_ctx->mpm_ctx_factory_container == NULL) {
65  if (de_ctx->mpm_ctx_factory_container == NULL) {
66  FatalError("Error allocating memory");
67  }
69  }
70 
72  MpmCtxFactoryItem *pitem = NULL;
73  while (item) {
74  if (item->sm_list == sm_list && item->alproto == alproto && item->name != NULL &&
75  strcmp(item->name, name) == 0) {
76  return item->id;
77  }
78  pitem = item;
79  item = item->next;
80  }
81 
82  MpmCtxFactoryItem *nitem = SCCalloc(1, sizeof(MpmCtxFactoryItem));
83  if (unlikely(nitem == NULL)) {
84  FatalError("Error allocating memory");
85  }
86  nitem->name = name;
87  nitem->sm_list = sm_list;
89  nitem->alproto = alproto;
90 
91  /* toserver */
92  nitem->mpm_ctx_ts = SCCalloc(1, sizeof(MpmCtx));
93  if (nitem->mpm_ctx_ts == NULL) {
94  FatalError("Error allocating memory");
95  }
97 
98  /* toclient */
99  nitem->mpm_ctx_tc = SCCalloc(1, sizeof(MpmCtx));
100  if (nitem->mpm_ctx_tc == NULL) {
101  FatalError("Error allocating memory");
102  }
104 
105  /* store the newly created item */
106  if (pitem == NULL)
108  else
109  pitem->next = nitem;
110 
112  return nitem->id;
113 }
114 
116 {
117  if (mpm_ctx == NULL)
118  return 0;
119 
120  if (de_ctx->mpm_ctx_factory_container == NULL) {
121  return 0;
122  }
123 
124  for (MpmCtxFactoryItem *i = de_ctx->mpm_ctx_factory_container->items; i != NULL; i = i->next) {
125  if (mpm_ctx == i->mpm_ctx_ts || mpm_ctx == i->mpm_ctx_tc) {
126  return 1;
127  }
128  }
129  return 0;
130 }
131 
132 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
133 {
134  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
135  MpmCtx *mpm_ctx = SCCalloc(1, sizeof(MpmCtx));
136  if (unlikely(mpm_ctx == NULL)) {
137  FatalError("Error allocating memory");
138  }
139  return mpm_ctx;
140  } else if (id < -1) {
141  SCLogError("Invalid argument - %d\n", id);
142  return NULL;
143  } else if (id >= de_ctx->mpm_ctx_factory_container->max_id) {
144  /* this id does not exist */
145  return NULL;
146  } else {
148  i = i->next) {
149  if (id == i->id) {
150  return (direction == 0) ? i->mpm_ctx_ts : i->mpm_ctx_tc;
151  }
152  }
153  return NULL;
154  }
155 }
156 
158 {
159  if (mpm_ctx == NULL)
160  return;
161 
162  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
163  if (mpm_ctx->mpm_type != MPM_NOTSET)
164  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
165  SCFree(mpm_ctx);
166  }
167 }
168 
170 {
171  if (de_ctx->mpm_ctx_factory_container == NULL)
172  return;
173 
175  while (item) {
176  if (item->mpm_ctx_ts != NULL) {
177  if (item->mpm_ctx_ts->mpm_type != MPM_NOTSET)
179  SCFree(item->mpm_ctx_ts);
180  }
181  if (item->mpm_ctx_tc != NULL) {
182  if (item->mpm_ctx_tc->mpm_type != MPM_NOTSET)
184  SCFree(item->mpm_ctx_tc);
185  }
186 
187  MpmCtxFactoryItem *next = item->next;
188  SCFree(item);
189  item = next;
190  }
191 
194 }
195 
196 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
197 {
198  if (mpm_table[matcher].InitThreadCtx != NULL) {
199  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
200  }
201 }
202 
203 void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
204 {
205  if (mpm_table[matcher].DestroyThreadCtx != NULL) {
206  mpm_table[matcher].DestroyThreadCtx(NULL, mpm_thread_ctx);
207  }
208 }
209 
210 void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
211 {
212  mpm_ctx->mpm_type = matcher;
213  mpm_table[matcher].InitCtx(mpm_ctx);
214 }
215 
216 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
217  * If Hyperscan is available, use it. Otherwise, use AC. */
218 #ifdef BUILD_HYPERSCAN
219 # define DEFAULT_MPM MPM_HS
220 # define DEFAULT_MPM_AC MPM_AC
221 #else
222 # define DEFAULT_MPM MPM_AC
223 #endif
224 
225 void MpmTableSetup(void)
226 {
227  memset(mpm_table, 0, sizeof(mpm_table));
229 
230  MpmACRegister();
232 #ifdef BUILD_HYPERSCAN
233  #ifdef HAVE_HS_VALID_PLATFORM
234  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
235  * check is not successful. */
236  if (hs_valid_platform() != HS_SUCCESS) {
237  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
238  "MPM");
239  /* Fall back to best Aho-Corasick variant. */
240  mpm_default_matcher = DEFAULT_MPM_AC;
241  } else {
242  MpmHSRegister();
243  }
244  #else
245  MpmHSRegister();
246  #endif /* HAVE_HS_VALID_PLATFORM */
247 #endif /* BUILD_HYPERSCAN */
248 }
249 
250 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
251  uint16_t offset, uint16_t depth,
252  uint32_t pid, SigIntId sid, uint8_t flags)
253 {
254  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
255  offset, depth,
256  pid, sid, flags);
257 }
258 
259 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
260  uint16_t offset, uint16_t depth,
261  uint32_t pid, SigIntId sid, uint8_t flags)
262 {
263  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
264  offset, depth,
265  pid, sid, flags);
266 }
267 
268 
269 /**
270  * \internal
271  * \brief Creates a hash of the pattern. We use it for the hashing process
272  * during the initial pattern insertion time, to cull duplicate sigs.
273  *
274  * \param pat Pointer to the pattern.
275  * \param patlen Pattern length.
276  *
277  * \retval hash A 32 bit unsigned hash.
278  */
279 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
280 {
281  uint32_t hash = patlen * pat[0];
282  if (patlen > 1)
283  hash += pat[1];
284 
285  return (hash % MPM_INIT_HASH_SIZE);
286 }
287 
288 /**
289  * \internal
290  * \brief Looks up a pattern. We use it for the hashing process during the
291  * the initial pattern insertion time, to cull duplicate sigs.
292  *
293  * \param ctx Pointer to the AC ctx.
294  * \param pat Pointer to the pattern.
295  * \param patlen Pattern length.
296  * \param flags Flags. We don't need this.
297  *
298  * \retval hash A 32 bit unsigned hash.
299  */
300 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
301  uint8_t *pat, uint16_t patlen,
302  uint16_t offset, uint16_t depth,
303  uint8_t flags, uint32_t pid)
304 {
305  uint32_t hash = MpmInitHashRaw(pat, patlen);
306 
307  if (ctx->init_hash == NULL) {
308  return NULL;
309  }
310 
311  MpmPattern *t = ctx->init_hash[hash];
312  for ( ; t != NULL; t = t->next) {
313  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
314  if (t->id == pid)
315  return t;
316  } else {
317  if (t->len == patlen && t->offset == offset && t->depth == depth &&
318  memcmp(pat, t->original_pat, patlen) == 0 &&
319  t->flags == flags)
320  {
321  return t;
322  }
323  }
324  }
325 
326  return NULL;
327 }
328 
329 /**
330  * \internal
331  * \brief Allocs a new pattern instance.
332  *
333  * \param mpm_ctx Pointer to the mpm context.
334  *
335  * \retval p Pointer to the newly created pattern.
336  */
337 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
338 {
339  MpmPattern *p = SCCalloc(1, sizeof(MpmPattern));
340  if (unlikely(p == NULL)) {
341  exit(EXIT_FAILURE);
342  }
343 
344  mpm_ctx->memory_cnt++;
345  mpm_ctx->memory_size += sizeof(MpmPattern);
346 
347  return p;
348 }
349 
350 /**
351  * \internal
352  * \brief Used to free MpmPattern instances.
353  *
354  * \param mpm_ctx Pointer to the mpm context.
355  * \param p Pointer to the MpmPattern instance to be freed.
356  */
357 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
358 {
359  if (p == NULL)
360  return;
361 
362  if (p->cs != NULL && p->cs != p->ci) {
363  SCFree(p->cs);
364  mpm_ctx->memory_cnt--;
365  mpm_ctx->memory_size -= p->len;
366  }
367 
368  if (p->ci != NULL) {
369  SCFree(p->ci);
370  mpm_ctx->memory_cnt--;
371  mpm_ctx->memory_size -= p->len;
372  }
373 
374  if (p->original_pat != NULL) {
375  SCFree(p->original_pat);
376  mpm_ctx->memory_cnt--;
377  mpm_ctx->memory_size -= p->len;
378  }
379 
380  if (p->sids != NULL) {
381  SCFree(p->sids);
382  }
383 
384  SCFree(p);
385  mpm_ctx->memory_cnt--;
386  mpm_ctx->memory_size -= sizeof(MpmPattern);
387 }
388 
389 static inline uint32_t MpmInitHash(MpmPattern *p)
390 {
391  uint32_t hash = p->len * p->original_pat[0];
392  if (p->len > 1)
393  hash += p->original_pat[1];
394 
395  return (hash % MPM_INIT_HASH_SIZE);
396 }
397 
398 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
399 {
400  uint32_t hash = MpmInitHash(p);
401 
402  if (ctx->init_hash == NULL) {
403  return -1;
404  }
405 
406  if (ctx->init_hash[hash] == NULL) {
407  ctx->init_hash[hash] = p;
408  return 0;
409  }
410 
411  MpmPattern *tt = NULL;
412  MpmPattern *t = ctx->init_hash[hash];
413 
414  /* get the list tail */
415  do {
416  tt = t;
417  t = t->next;
418  } while (t != NULL);
419 
420  tt->next = p;
421 
422  return 0;
423 }
424 
425 /**
426  * \internal
427  * \brief Add a pattern to the mpm-ac context.
428  *
429  * \param mpm_ctx Mpm context.
430  * \param pat Pointer to the pattern.
431  * \param patlen Length of the pattern.
432  * \param pid Pattern id
433  * \param sid Signature id (internal id).
434  * \param flags Pattern's MPM_PATTERN_* flags.
435  *
436  * \retval 0 On success.
437  * \retval -1 On failure.
438  */
439 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
440  uint16_t offset, uint16_t depth, uint32_t pid,
441  SigIntId sid, uint8_t flags)
442 {
443  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
444  mpm_ctx, patlen, pid);
445 
446  if (patlen == 0) {
447  SCLogWarning("pattern length 0");
448  return 0;
449  }
450 
452  pid = UINT_MAX;
453 
454  /* check if we have already inserted this pattern */
455  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
456  offset, depth, flags, pid);
457  if (p == NULL) {
458  SCLogDebug("Allocing new pattern");
459 
460  /* p will never be NULL */
461  p = MpmAllocPattern(mpm_ctx);
462 
463  p->len = patlen;
464  p->flags = flags;
465  p->offset = offset;
466  p->depth = depth;
468  p->id = mpm_ctx->max_pat_id++;
469  else
470  p->id = pid;
471 
472  p->original_pat = SCMalloc(patlen);
473  if (p->original_pat == NULL)
474  goto error;
475  mpm_ctx->memory_cnt++;
476  mpm_ctx->memory_size += patlen;
477  memcpy(p->original_pat, pat, patlen);
478 
479  p->ci = SCMalloc(patlen);
480  if (p->ci == NULL)
481  goto error;
482  mpm_ctx->memory_cnt++;
483  mpm_ctx->memory_size += patlen;
484  memcpy_tolower(p->ci, pat, patlen);
485 
486  /* setup the case sensitive part of the pattern */
487  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
488  /* nocase means no difference between cs and ci */
489  p->cs = p->ci;
490  } else {
491  if (memcmp(p->ci, pat, p->len) == 0) {
492  /* no diff between cs and ci: pat is lowercase */
493  p->cs = p->ci;
494  } else {
495  p->cs = SCMalloc(patlen);
496  if (p->cs == NULL)
497  goto error;
498  mpm_ctx->memory_cnt++;
499  mpm_ctx->memory_size += patlen;
500  memcpy(p->cs, pat, patlen);
501  }
502  }
503 
504  /* put in the pattern hash */
505  if (MpmInitHashAdd(mpm_ctx, p) != 0)
506  goto error;
507 
508  mpm_ctx->pattern_cnt++;
509 
510  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
511  if (depth) {
512  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
513  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
514  } else {
515  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
516  mpm_ctx->maxdepth = 0;
517  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
518  }
519  }
520 
521  if (mpm_ctx->maxlen < patlen)
522  mpm_ctx->maxlen = patlen;
523 
524  if (mpm_ctx->minlen == 0) {
525  mpm_ctx->minlen = patlen;
526  } else {
527  if (mpm_ctx->minlen > patlen)
528  mpm_ctx->minlen = patlen;
529  }
530 
531  /* we need the max pat id */
532  if (p->id > mpm_ctx->max_pat_id)
533  mpm_ctx->max_pat_id = p->id;
534 
535  p->sids_size = 1;
536  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
537  BUG_ON(p->sids == NULL);
538  p->sids[0] = sid;
539  } else {
540  /* we can be called multiple times for the same sid in the case
541  * of the 'single' modus. Here multiple rule groups share the
542  * same mpm ctx and might be adding the same pattern to the
543  * mpm_ctx */
544  int found = 0;
545  uint32_t x = 0;
546  for (x = 0; x < p->sids_size; x++) {
547  if (p->sids[x] == sid) {
548  found = 1;
549  break;
550  }
551  }
552 
553  if (!found) {
554  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
555  BUG_ON(sids == NULL);
556  p->sids = sids;
557  p->sids[p->sids_size] = sid;
558  p->sids_size++;
559  }
560  }
561 
562  return 0;
563 
564 error:
565  MpmFreePattern(mpm_ctx, p);
566  return -1;
567 }
568 
569 
570 /************************************Unittests*********************************/
571 
572 #ifdef UNITTESTS
573 #endif /* UNITTESTS */
574 
576 {
577 #ifdef UNITTESTS
578  uint16_t i;
579 
580  for (i = 0; i < MPM_TABLE_SIZE; i++) {
581  if (i == MPM_NOTSET)
582  continue;
583 
584  g_ut_modules++;
585 
586  if (mpm_table[i].RegisterUnittests != NULL) {
587  g_ut_covered++;
589  } else {
590  if (coverage_unittests)
591  SCLogWarning("mpm module %s has no "
592  "unittest registration function.",
593  mpm_table[i].name);
594  }
595  }
596 
597 #endif
598 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:196
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:149
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:169
g_ut_modules
int g_ut_modules
Definition: suricata.c:886
MpmThreadCtx_
Definition: util-mpm.h:46
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:357
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:157
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
util-mpm-ac-ks.h
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:575
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:103
g_ut_covered
int g_ut_covered
Definition: suricata.c:887
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:165
MpmCtxFactoryItem::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:164
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:898
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:94
MAX
#define MAX(x, y)
Definition: suricata-common.h:395
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:148
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:210
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:222
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:105
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem::name
const char * name
Definition: util-mpm.h:116
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:203
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:115
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:132
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:139
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:33
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:126
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
Definition: util-mpm.c:59
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:30
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:54
MpmCtxFactoryItem::sm_list
int32_t sm_list
Definition: util-mpm.h:120
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:225
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:250
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:86
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1398
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
#define ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
Definition: detect.h:1063
MpmCtxFactoryItem::next
struct MpmCtxFactoryItem * next
Definition: util-mpm.h:122
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:132
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
FatalError
#define FatalError(...)
Definition: util-debug.h:502
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:150
MpmCtxFactoryItem
Definition: util-mpm.h:115
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1127
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:127
MpmCtxFactoryItem::alproto
AppProto alproto
Definition: util-mpm.h:121
MpmCtxFactoryItem::id
int32_t id
Definition: util-mpm.h:119
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:102
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:108
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
MpmCtxFactoryItem::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:439
MpmTableElmt_::DestroyThreadCtx
void(* DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:151
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:128
coverage_unittests
int coverage_unittests
Definition: suricata.c:885
MpmCtx_
Definition: util-mpm.h:88
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:315
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
MpmTableElmt_
Definition: util-mpm.h:146
MpmHSRegister
void MpmHSRegister(void)
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:259
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:172
MpmCtxFactoryContainer_
Definition: util-mpm.h:125