suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-bs.h"
33 #include "util-mpm-ac-ks.h"
34 #include "util-mpm-hs.h"
35 #include "util-hashlist.h"
36 
37 #include "detect-engine.h"
38 #include "util-misc.h"
39 #include "conf.h"
40 #include "conf-yaml-loader.h"
41 #include "queue.h"
42 #include "util-unittest.h"
43 #include "util-memcpy.h"
44 #ifdef BUILD_HYPERSCAN
45 #include "hs.h"
46 #endif
47 
50 
51 /**
52  * \brief Register a new Mpm Context.
53  *
54  * \param name A new profile to be registered to store this MpmCtx.
55  *
56  * \retval id Return the id created for the new MpmCtx profile.
57  */
59 {
60  void *ptmp;
61  /* the very first entry */
62  if (de_ctx->mpm_ctx_factory_container == NULL) {
64  if (de_ctx->mpm_ctx_factory_container == NULL) {
65  FatalError(SC_ERR_FATAL, "Error allocating memory");
66  }
68 
70  if (unlikely(item == NULL)) {
71  FatalError(SC_ERR_FATAL, "Error allocating memory");
72  }
73 
74  item[0].name = name;
75 
76  /* toserver */
77  item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
78  if (item[0].mpm_ctx_ts == NULL) {
79  FatalError(SC_ERR_FATAL, "Error allocating memory");
80  }
81  memset(item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
83 
84  /* toclient */
85  item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
86  if (item[0].mpm_ctx_tc == NULL) {
87  FatalError(SC_ERR_FATAL, "Error allocating memory");
88  }
89  memset(item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
91 
92  /* our id starts from 0 always. Helps us with the ctx retrieval from
93  * the array */
94  item[0].id = 0;
95 
96  /* store the newly created item */
99 
100  /* the first id is always 0 */
101  return item[0].id;
102  } else {
103  int i;
105  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
106  if (items[i].name != NULL && strcmp(items[i].name, name) == 0) {
107  /* looks like we have this mpm_ctx freed */
108  if (items[i].mpm_ctx_ts == NULL) {
109  items[i].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
110  if (items[i].mpm_ctx_ts == NULL) {
111  FatalError(SC_ERR_FATAL, "Error allocating memory");
112  }
113  memset(items[i].mpm_ctx_ts, 0, sizeof(MpmCtx));
114  items[i].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
115  }
116  if (items[i].mpm_ctx_tc == NULL) {
117  items[i].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
118  if (items[i].mpm_ctx_tc == NULL) {
119  FatalError(SC_ERR_FATAL, "Error allocating memory");
120  }
121  memset(items[i].mpm_ctx_tc, 0, sizeof(MpmCtx));
122  items[i].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
123  }
124  return items[i].id;
125  }
126  }
127 
128  /* let's make the new entry */
129  ptmp = SCRealloc(items,
131  if (unlikely(ptmp == NULL)) {
132  SCFree(items);
133  items = NULL;
134  FatalError(SC_ERR_FATAL, "Error allocating memory");
135  }
136  items = ptmp;
137 
139 
141  new_item[0].name = name;
142 
143  /* toserver */
144  new_item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
145  if (new_item[0].mpm_ctx_ts == NULL) {
146  FatalError(SC_ERR_FATAL, "Error allocating memory");
147  }
148  memset(new_item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
149  new_item[0].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
150 
151  /* toclient */
152  new_item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
153  if (new_item[0].mpm_ctx_tc == NULL) {
154  FatalError(SC_ERR_FATAL, "Error allocating memory");
155  }
156  memset(new_item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
157  new_item[0].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
158 
161 
162  /* the newly created id */
163  return new_item[0].id;
164  }
165 }
166 
168 {
169  if (mpm_ctx == NULL)
170  return 0;
171 
172  if (de_ctx->mpm_ctx_factory_container == NULL) {
173  return 0;
174  } else {
175  int i;
176  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
177  if (mpm_ctx == de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_ts ||
179  return 1;
180  }
181  }
182  return 0;
183  }
184 }
185 
186 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
187 {
188  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
189  MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx));
190  if (unlikely(mpm_ctx == NULL)) {
191  FatalError(SC_ERR_FATAL, "Error allocating memory");
192  }
193  memset(mpm_ctx, 0, sizeof(MpmCtx));
194  return mpm_ctx;
195  } else if (id < -1) {
196  SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument - %d\n", id);
197  return NULL;
198  } else if (id >= de_ctx->mpm_ctx_factory_container->no_of_items) {
199  /* this id does not exist */
200  return NULL;
201  } else {
202  return (direction == 0) ?
205  }
206 }
207 
209 {
210  if (mpm_ctx == NULL)
211  return;
212 
213  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
214  if (mpm_ctx->mpm_type != MPM_NOTSET)
215  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
216  SCFree(mpm_ctx);
217  }
218 
219  return;
220 }
221 
223 {
224  if (de_ctx->mpm_ctx_factory_container == NULL)
225  return;
226 
227  int i = 0;
229  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
230  if (items[i].mpm_ctx_ts != NULL) {
231  if (items[i].mpm_ctx_ts->mpm_type != MPM_NOTSET)
232  mpm_table[items[i].mpm_ctx_ts->mpm_type].DestroyCtx(items[i].mpm_ctx_ts);
233  SCFree(items[i].mpm_ctx_ts);
234  }
235  if (items[i].mpm_ctx_tc != NULL) {
236  if (items[i].mpm_ctx_tc->mpm_type != MPM_NOTSET)
237  mpm_table[items[i].mpm_ctx_tc->mpm_type].DestroyCtx(items[i].mpm_ctx_tc);
238  SCFree(items[i].mpm_ctx_tc);
239  }
240  }
241 
245 
246  return;
247 }
248 
249 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
250 {
251  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
252 }
253 
254 void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher)
255 {
256  mpm_ctx->mpm_type = matcher;
257  mpm_table[matcher].InitCtx(mpm_ctx);
258 }
259 
260 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
261  * If Hyperscan is available, use it. Otherwise, use AC. */
262 #ifdef BUILD_HYPERSCAN
263 # define DEFAULT_MPM MPM_HS
264 # define DEFAULT_MPM_AC MPM_AC
265 #else
266 # define DEFAULT_MPM MPM_AC
267 #endif
268 
269 void MpmTableSetup(void)
270 {
271  memset(mpm_table, 0, sizeof(mpm_table));
273 
274  MpmACRegister();
275  MpmACBSRegister();
277 #ifdef BUILD_HYPERSCAN
278  #ifdef HAVE_HS_VALID_PLATFORM
279  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
280  * check is not successful. */
281  if (hs_valid_platform() != HS_SUCCESS) {
282  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
283  "MPM");
284  /* Fall back to best Aho-Corasick variant. */
285  mpm_default_matcher = DEFAULT_MPM_AC;
286  } else {
287  MpmHSRegister();
288  }
289  #else
290  MpmHSRegister();
291  #endif /* HAVE_HS_VALID_PLATFORM */
292 #endif /* BUILD_HYPERSCAN */
293 }
294 
295 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
296  uint16_t offset, uint16_t depth,
297  uint32_t pid, SigIntId sid, uint8_t flags)
298 {
299  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
300  offset, depth,
301  pid, sid, flags);
302 }
303 
304 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
305  uint16_t offset, uint16_t depth,
306  uint32_t pid, SigIntId sid, uint8_t flags)
307 {
308  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
309  offset, depth,
310  pid, sid, flags);
311 }
312 
313 
314 /**
315  * \internal
316  * \brief Creates a hash of the pattern. We use it for the hashing process
317  * during the initial pattern insertion time, to cull duplicate sigs.
318  *
319  * \param pat Pointer to the pattern.
320  * \param patlen Pattern length.
321  *
322  * \retval hash A 32 bit unsigned hash.
323  */
324 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
325 {
326  uint32_t hash = patlen * pat[0];
327  if (patlen > 1)
328  hash += pat[1];
329 
330  return (hash % MPM_INIT_HASH_SIZE);
331 }
332 
333 /**
334  * \internal
335  * \brief Looks up a pattern. We use it for the hashing process during the
336  * the initial pattern insertion time, to cull duplicate sigs.
337  *
338  * \param ctx Pointer to the AC ctx.
339  * \param pat Pointer to the pattern.
340  * \param patlen Pattern length.
341  * \param flags Flags. We don't need this.
342  *
343  * \retval hash A 32 bit unsigned hash.
344  */
345 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
346  uint8_t *pat, uint16_t patlen,
347  uint16_t offset, uint16_t depth,
348  uint8_t flags, uint32_t pid)
349 {
350  uint32_t hash = MpmInitHashRaw(pat, patlen);
351 
352  if (ctx->init_hash == NULL) {
353  return NULL;
354  }
355 
356  MpmPattern *t = ctx->init_hash[hash];
357  for ( ; t != NULL; t = t->next) {
358  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
359  if (t->id == pid)
360  return t;
361  } else {
362  if (t->len == patlen && t->offset == offset && t->depth == depth &&
363  memcmp(pat, t->original_pat, patlen) == 0 &&
364  t->flags == flags)
365  {
366  return t;
367  }
368  }
369  }
370 
371  return NULL;
372 }
373 
374 /**
375  * \internal
376  * \brief Allocs a new pattern instance.
377  *
378  * \param mpm_ctx Pointer to the mpm context.
379  *
380  * \retval p Pointer to the newly created pattern.
381  */
382 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
383 {
384  MpmPattern *p = SCMalloc(sizeof(MpmPattern));
385  if (unlikely(p == NULL)) {
386  exit(EXIT_FAILURE);
387  }
388  memset(p, 0, sizeof(MpmPattern));
389 
390  mpm_ctx->memory_cnt++;
391  mpm_ctx->memory_size += sizeof(MpmPattern);
392 
393  return p;
394 }
395 
396 /**
397  * \internal
398  * \brief Used to free MpmPattern instances.
399  *
400  * \param mpm_ctx Pointer to the mpm context.
401  * \param p Pointer to the MpmPattern instance to be freed.
402  */
403 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
404 {
405  if (p != NULL && p->cs != NULL && p->cs != p->ci) {
406  SCFree(p->cs);
407  mpm_ctx->memory_cnt--;
408  mpm_ctx->memory_size -= p->len;
409  }
410 
411  if (p != NULL && p->ci != NULL) {
412  SCFree(p->ci);
413  mpm_ctx->memory_cnt--;
414  mpm_ctx->memory_size -= p->len;
415  }
416 
417  if (p != NULL && p->original_pat != NULL) {
418  SCFree(p->original_pat);
419  mpm_ctx->memory_cnt--;
420  mpm_ctx->memory_size -= p->len;
421  }
422 
423  if (p != NULL) {
424  SCFree(p);
425  mpm_ctx->memory_cnt--;
426  mpm_ctx->memory_size -= sizeof(MpmPattern);
427  }
428  return;
429 }
430 
431 static inline uint32_t MpmInitHash(MpmPattern *p)
432 {
433  uint32_t hash = p->len * p->original_pat[0];
434  if (p->len > 1)
435  hash += p->original_pat[1];
436 
437  return (hash % MPM_INIT_HASH_SIZE);
438 }
439 
440 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
441 {
442  uint32_t hash = MpmInitHash(p);
443 
444  if (ctx->init_hash == NULL) {
445  return -1;
446  }
447 
448  if (ctx->init_hash[hash] == NULL) {
449  ctx->init_hash[hash] = p;
450  return 0;
451  }
452 
453  MpmPattern *tt = NULL;
454  MpmPattern *t = ctx->init_hash[hash];
455 
456  /* get the list tail */
457  do {
458  tt = t;
459  t = t->next;
460  } while (t != NULL);
461 
462  tt->next = p;
463 
464  return 0;
465 }
466 
467 /**
468  * \internal
469  * \brief Add a pattern to the mpm-ac context.
470  *
471  * \param mpm_ctx Mpm context.
472  * \param pat Pointer to the pattern.
473  * \param patlen Length of the pattern.
474  * \param pid Pattern id
475  * \param sid Signature id (internal id).
476  * \param flags Pattern's MPM_PATTERN_* flags.
477  *
478  * \retval 0 On success.
479  * \retval -1 On failure.
480  */
481 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
482  uint16_t offset, uint16_t depth, uint32_t pid,
483  SigIntId sid, uint8_t flags)
484 {
485  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
486  mpm_ctx, patlen, pid);
487 
488  if (patlen == 0) {
489  SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0");
490  return 0;
491  }
492 
494  pid = UINT_MAX;
495 
496  /* check if we have already inserted this pattern */
497  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
498  offset, depth, flags, pid);
499  if (p == NULL) {
500  SCLogDebug("Allocing new pattern");
501 
502  /* p will never be NULL */
503  p = MpmAllocPattern(mpm_ctx);
504 
505  p->len = patlen;
506  p->flags = flags;
507  p->offset = offset;
508  p->depth = depth;
510  p->id = mpm_ctx->max_pat_id++;
511  else
512  p->id = pid;
513 
514  p->original_pat = SCMalloc(patlen);
515  if (p->original_pat == NULL)
516  goto error;
517  mpm_ctx->memory_cnt++;
518  mpm_ctx->memory_size += patlen;
519  memcpy(p->original_pat, pat, patlen);
520 
521  p->ci = SCMalloc(patlen);
522  if (p->ci == NULL)
523  goto error;
524  mpm_ctx->memory_cnt++;
525  mpm_ctx->memory_size += patlen;
526  memcpy_tolower(p->ci, pat, patlen);
527 
528  /* setup the case sensitive part of the pattern */
529  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
530  /* nocase means no difference between cs and ci */
531  p->cs = p->ci;
532  } else {
533  if (memcmp(p->ci, pat, p->len) == 0) {
534  /* no diff between cs and ci: pat is lowercase */
535  p->cs = p->ci;
536  } else {
537  p->cs = SCMalloc(patlen);
538  if (p->cs == NULL)
539  goto error;
540  mpm_ctx->memory_cnt++;
541  mpm_ctx->memory_size += patlen;
542  memcpy(p->cs, pat, patlen);
543  }
544  }
545 
546  /* put in the pattern hash */
547  if (MpmInitHashAdd(mpm_ctx, p) != 0)
548  goto error;
549 
550  mpm_ctx->pattern_cnt++;
551 
552  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
553  if (depth) {
554  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
555  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
556  } else {
557  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
558  mpm_ctx->maxdepth = 0;
559  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
560  }
561  }
562 
563  if (mpm_ctx->maxlen < patlen)
564  mpm_ctx->maxlen = patlen;
565 
566  if (mpm_ctx->minlen == 0) {
567  mpm_ctx->minlen = patlen;
568  } else {
569  if (mpm_ctx->minlen > patlen)
570  mpm_ctx->minlen = patlen;
571  }
572 
573  /* we need the max pat id */
574  if (p->id > mpm_ctx->max_pat_id)
575  mpm_ctx->max_pat_id = p->id;
576 
577  p->sids_size = 1;
578  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
579  BUG_ON(p->sids == NULL);
580  p->sids[0] = sid;
581  } else {
582  /* we can be called multiple times for the same sid in the case
583  * of the 'single' modus. Here multiple rule groups share the
584  * same mpm ctx and might be adding the same pattern to the
585  * mpm_ctx */
586  int found = 0;
587  uint32_t x = 0;
588  for (x = 0; x < p->sids_size; x++) {
589  if (p->sids[x] == sid) {
590  found = 1;
591  break;
592  }
593  }
594 
595  if (!found) {
596  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
597  BUG_ON(sids == NULL);
598  p->sids = sids;
599  p->sids[p->sids_size] = sid;
600  p->sids_size++;
601  }
602  }
603 
604  return 0;
605 
606 error:
607  MpmFreePattern(mpm_ctx, p);
608  return -1;
609 }
610 
611 
612 /************************************Unittests*********************************/
613 
614 #ifdef UNITTESTS
615 #endif /* UNITTESTS */
616 
618 {
619 #ifdef UNITTESTS
620  uint16_t i;
621 
622  for (i = 0; i < MPM_TABLE_SIZE; i++) {
623  if (i == MPM_NOTSET)
624  continue;
625 
626  g_ut_modules++;
627 
628  if (mpm_table[i].RegisterUnittests != NULL) {
629  g_ut_covered++;
631  } else {
632  if (coverage_unittests)
633  SCLogWarning(SC_WARN_NO_UNITTESTS, "mpm module %s has no "
634  "unittest registration function.", mpm_table[i].name);
635  }
636  }
637 
638 #endif
639 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:249
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
MpmCtxFactoryItem_::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:144
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:222
g_ut_modules
int g_ut_modules
Definition: suricata.c:834
MpmThreadCtx_
Definition: util-mpm.h:46
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:403
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:208
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
util-mpm-ac-ks.h
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:254
MpmCtxFactoryItem_::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:617
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:103
g_ut_covered
int g_ut_covered
Definition: suricata.c:835
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:160
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:159
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:836
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:94
MAX
#define MAX(x, y)
Definition: suricata-common.h:381
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:143
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
MpmCtxFactoryItem_::name
const char * name
Definition: util-mpm.h:116
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:266
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:105
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem_::id
int32_t id
Definition: util-mpm.h:119
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:167
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:186
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:139
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:123
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:32
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:29
MpmCtxFactoryItem_
Definition: util-mpm.h:115
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:54
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:269
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:295
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:86
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1457
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:128
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
MpmACBSRegister
void MpmACBSRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac-bs.c:95
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
util-mpm-ac-bs.h
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:145
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1229
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:124
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
mpm_default_matcher
int mpm_default_matcher
Definition: util-mpm.c:49
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:102
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:108
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name)
Register a new Mpm Context.
Definition: util-mpm.c:58
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:481
coverage_unittests
int coverage_unittests
Definition: suricata.c:833
MpmCtx_
Definition: util-mpm.h:88
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:297
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
MpmTableElmt_
Definition: util-mpm.h:141
MpmHSRegister
void MpmHSRegister(void)
SC_WARN_NO_UNITTESTS
@ SC_WARN_NO_UNITTESTS
Definition: util-error.h:266
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:304
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:165
MpmCtxFactoryContainer_
Definition: util-mpm.h:122