suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-bs.h"
33 #include "util-mpm-ac-ks.h"
34 #include "util-mpm-hs.h"
35 #include "util-hashlist.h"
36 
37 #include "detect-engine.h"
38 #include "util-misc.h"
39 #include "conf.h"
40 #include "conf-yaml-loader.h"
41 #include "queue.h"
42 #include "util-unittest.h"
43 #include "util-memcpy.h"
44 #ifdef BUILD_HYPERSCAN
45 #include "hs.h"
46 #endif
47 
50 
51 /**
52  * \brief Register a new Mpm Context.
53  *
54  * \param name A new profile to be registered to store this MpmCtx.
55  * \param sm_list sm_list for this name (might be variable with xforms)
56  * \param alproto app proto or ALPROTO_UNKNOWN if not for app-layer
57  *
58  * \retval id Return the id created for the new MpmCtx profile.
59  */
61  DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
62 {
63  /* the very first entry */
64  if (de_ctx->mpm_ctx_factory_container == NULL) {
66  if (de_ctx->mpm_ctx_factory_container == NULL) {
67  FatalError("Error allocating memory");
68  }
70  }
71 
73  MpmCtxFactoryItem *pitem = NULL;
74  while (item) {
75  if (item->sm_list == sm_list && item->alproto == alproto && item->name != NULL &&
76  strcmp(item->name, name) == 0) {
77  return item->id;
78  }
79  pitem = item;
80  item = item->next;
81  }
82 
83  MpmCtxFactoryItem *nitem = SCCalloc(1, sizeof(MpmCtxFactoryItem));
84  if (unlikely(nitem == NULL)) {
85  FatalError("Error allocating memory");
86  }
87  nitem->name = name;
88  nitem->sm_list = sm_list;
90  nitem->alproto = alproto;
91 
92  /* toserver */
93  nitem->mpm_ctx_ts = SCCalloc(1, sizeof(MpmCtx));
94  if (nitem->mpm_ctx_ts == NULL) {
95  FatalError("Error allocating memory");
96  }
98 
99  /* toclient */
100  nitem->mpm_ctx_tc = SCCalloc(1, sizeof(MpmCtx));
101  if (nitem->mpm_ctx_tc == NULL) {
102  FatalError("Error allocating memory");
103  }
105 
106  /* store the newly created item */
107  if (pitem == NULL)
109  else
110  pitem->next = nitem;
111 
113  return nitem->id;
114 }
115 
117 {
118  if (mpm_ctx == NULL)
119  return 0;
120 
121  if (de_ctx->mpm_ctx_factory_container == NULL) {
122  return 0;
123  }
124 
125  for (MpmCtxFactoryItem *i = de_ctx->mpm_ctx_factory_container->items; i != NULL; i = i->next) {
126  if (mpm_ctx == i->mpm_ctx_ts || mpm_ctx == i->mpm_ctx_tc) {
127  return 1;
128  }
129  }
130  return 0;
131 }
132 
133 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
134 {
135  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
136  MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx));
137  if (unlikely(mpm_ctx == NULL)) {
138  FatalError("Error allocating memory");
139  }
140  memset(mpm_ctx, 0, sizeof(MpmCtx));
141  return mpm_ctx;
142  } else if (id < -1) {
143  SCLogError("Invalid argument - %d\n", id);
144  return NULL;
145  } else if (id >= de_ctx->mpm_ctx_factory_container->max_id) {
146  /* this id does not exist */
147  return NULL;
148  } else {
150  i = i->next) {
151  if (id == i->id) {
152  return (direction == 0) ? i->mpm_ctx_ts : i->mpm_ctx_tc;
153  }
154  }
155  return NULL;
156  }
157 }
158 
160 {
161  if (mpm_ctx == NULL)
162  return;
163 
164  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
165  if (mpm_ctx->mpm_type != MPM_NOTSET)
166  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
167  SCFree(mpm_ctx);
168  }
169 }
170 
172 {
173  if (de_ctx->mpm_ctx_factory_container == NULL)
174  return;
175 
177  while (item) {
178  if (item->mpm_ctx_ts != NULL) {
179  if (item->mpm_ctx_ts->mpm_type != MPM_NOTSET)
181  SCFree(item->mpm_ctx_ts);
182  }
183  if (item->mpm_ctx_tc != NULL) {
184  if (item->mpm_ctx_tc->mpm_type != MPM_NOTSET)
186  SCFree(item->mpm_ctx_tc);
187  }
188 
189  MpmCtxFactoryItem *next = item->next;
190  SCFree(item);
191  item = next;
192  }
193 
196 }
197 
198 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
199 {
200  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
201 }
202 
203 void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
204 {
205  mpm_ctx->mpm_type = matcher;
206  mpm_table[matcher].InitCtx(mpm_ctx);
207 }
208 
209 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
210  * If Hyperscan is available, use it. Otherwise, use AC. */
211 #ifdef BUILD_HYPERSCAN
212 # define DEFAULT_MPM MPM_HS
213 # define DEFAULT_MPM_AC MPM_AC
214 #else
215 # define DEFAULT_MPM MPM_AC
216 #endif
217 
218 void MpmTableSetup(void)
219 {
220  memset(mpm_table, 0, sizeof(mpm_table));
222 
223  MpmACRegister();
224  MpmACBSRegister();
226 #ifdef BUILD_HYPERSCAN
227  #ifdef HAVE_HS_VALID_PLATFORM
228  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
229  * check is not successful. */
230  if (hs_valid_platform() != HS_SUCCESS) {
231  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
232  "MPM");
233  /* Fall back to best Aho-Corasick variant. */
234  mpm_default_matcher = DEFAULT_MPM_AC;
235  } else {
236  MpmHSRegister();
237  }
238  #else
239  MpmHSRegister();
240  #endif /* HAVE_HS_VALID_PLATFORM */
241 #endif /* BUILD_HYPERSCAN */
242 }
243 
244 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
245  uint16_t offset, uint16_t depth,
246  uint32_t pid, SigIntId sid, uint8_t flags)
247 {
248  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
249  offset, depth,
250  pid, sid, flags);
251 }
252 
253 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
254  uint16_t offset, uint16_t depth,
255  uint32_t pid, SigIntId sid, uint8_t flags)
256 {
257  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
258  offset, depth,
259  pid, sid, flags);
260 }
261 
262 
263 /**
264  * \internal
265  * \brief Creates a hash of the pattern. We use it for the hashing process
266  * during the initial pattern insertion time, to cull duplicate sigs.
267  *
268  * \param pat Pointer to the pattern.
269  * \param patlen Pattern length.
270  *
271  * \retval hash A 32 bit unsigned hash.
272  */
273 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
274 {
275  uint32_t hash = patlen * pat[0];
276  if (patlen > 1)
277  hash += pat[1];
278 
279  return (hash % MPM_INIT_HASH_SIZE);
280 }
281 
282 /**
283  * \internal
284  * \brief Looks up a pattern. We use it for the hashing process during the
285  * the initial pattern insertion time, to cull duplicate sigs.
286  *
287  * \param ctx Pointer to the AC ctx.
288  * \param pat Pointer to the pattern.
289  * \param patlen Pattern length.
290  * \param flags Flags. We don't need this.
291  *
292  * \retval hash A 32 bit unsigned hash.
293  */
294 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
295  uint8_t *pat, uint16_t patlen,
296  uint16_t offset, uint16_t depth,
297  uint8_t flags, uint32_t pid)
298 {
299  uint32_t hash = MpmInitHashRaw(pat, patlen);
300 
301  if (ctx->init_hash == NULL) {
302  return NULL;
303  }
304 
305  MpmPattern *t = ctx->init_hash[hash];
306  for ( ; t != NULL; t = t->next) {
307  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
308  if (t->id == pid)
309  return t;
310  } else {
311  if (t->len == patlen && t->offset == offset && t->depth == depth &&
312  memcmp(pat, t->original_pat, patlen) == 0 &&
313  t->flags == flags)
314  {
315  return t;
316  }
317  }
318  }
319 
320  return NULL;
321 }
322 
323 /**
324  * \internal
325  * \brief Allocs a new pattern instance.
326  *
327  * \param mpm_ctx Pointer to the mpm context.
328  *
329  * \retval p Pointer to the newly created pattern.
330  */
331 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
332 {
333  MpmPattern *p = SCMalloc(sizeof(MpmPattern));
334  if (unlikely(p == NULL)) {
335  exit(EXIT_FAILURE);
336  }
337  memset(p, 0, sizeof(MpmPattern));
338 
339  mpm_ctx->memory_cnt++;
340  mpm_ctx->memory_size += sizeof(MpmPattern);
341 
342  return p;
343 }
344 
345 /**
346  * \internal
347  * \brief Used to free MpmPattern instances.
348  *
349  * \param mpm_ctx Pointer to the mpm context.
350  * \param p Pointer to the MpmPattern instance to be freed.
351  */
352 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
353 {
354  if (p != NULL && p->cs != NULL && p->cs != p->ci) {
355  SCFree(p->cs);
356  mpm_ctx->memory_cnt--;
357  mpm_ctx->memory_size -= p->len;
358  }
359 
360  if (p != NULL && p->ci != NULL) {
361  SCFree(p->ci);
362  mpm_ctx->memory_cnt--;
363  mpm_ctx->memory_size -= p->len;
364  }
365 
366  if (p != NULL && p->original_pat != NULL) {
367  SCFree(p->original_pat);
368  mpm_ctx->memory_cnt--;
369  mpm_ctx->memory_size -= p->len;
370  }
371 
372  if (p != NULL) {
373  SCFree(p);
374  mpm_ctx->memory_cnt--;
375  mpm_ctx->memory_size -= sizeof(MpmPattern);
376  }
377  return;
378 }
379 
380 static inline uint32_t MpmInitHash(MpmPattern *p)
381 {
382  uint32_t hash = p->len * p->original_pat[0];
383  if (p->len > 1)
384  hash += p->original_pat[1];
385 
386  return (hash % MPM_INIT_HASH_SIZE);
387 }
388 
389 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
390 {
391  uint32_t hash = MpmInitHash(p);
392 
393  if (ctx->init_hash == NULL) {
394  return -1;
395  }
396 
397  if (ctx->init_hash[hash] == NULL) {
398  ctx->init_hash[hash] = p;
399  return 0;
400  }
401 
402  MpmPattern *tt = NULL;
403  MpmPattern *t = ctx->init_hash[hash];
404 
405  /* get the list tail */
406  do {
407  tt = t;
408  t = t->next;
409  } while (t != NULL);
410 
411  tt->next = p;
412 
413  return 0;
414 }
415 
416 /**
417  * \internal
418  * \brief Add a pattern to the mpm-ac context.
419  *
420  * \param mpm_ctx Mpm context.
421  * \param pat Pointer to the pattern.
422  * \param patlen Length of the pattern.
423  * \param pid Pattern id
424  * \param sid Signature id (internal id).
425  * \param flags Pattern's MPM_PATTERN_* flags.
426  *
427  * \retval 0 On success.
428  * \retval -1 On failure.
429  */
430 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
431  uint16_t offset, uint16_t depth, uint32_t pid,
432  SigIntId sid, uint8_t flags)
433 {
434  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
435  mpm_ctx, patlen, pid);
436 
437  if (patlen == 0) {
438  SCLogWarning("pattern length 0");
439  return 0;
440  }
441 
443  pid = UINT_MAX;
444 
445  /* check if we have already inserted this pattern */
446  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
447  offset, depth, flags, pid);
448  if (p == NULL) {
449  SCLogDebug("Allocing new pattern");
450 
451  /* p will never be NULL */
452  p = MpmAllocPattern(mpm_ctx);
453 
454  p->len = patlen;
455  p->flags = flags;
456  p->offset = offset;
457  p->depth = depth;
459  p->id = mpm_ctx->max_pat_id++;
460  else
461  p->id = pid;
462 
463  p->original_pat = SCMalloc(patlen);
464  if (p->original_pat == NULL)
465  goto error;
466  mpm_ctx->memory_cnt++;
467  mpm_ctx->memory_size += patlen;
468  memcpy(p->original_pat, pat, patlen);
469 
470  p->ci = SCMalloc(patlen);
471  if (p->ci == NULL)
472  goto error;
473  mpm_ctx->memory_cnt++;
474  mpm_ctx->memory_size += patlen;
475  memcpy_tolower(p->ci, pat, patlen);
476 
477  /* setup the case sensitive part of the pattern */
478  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
479  /* nocase means no difference between cs and ci */
480  p->cs = p->ci;
481  } else {
482  if (memcmp(p->ci, pat, p->len) == 0) {
483  /* no diff between cs and ci: pat is lowercase */
484  p->cs = p->ci;
485  } else {
486  p->cs = SCMalloc(patlen);
487  if (p->cs == NULL)
488  goto error;
489  mpm_ctx->memory_cnt++;
490  mpm_ctx->memory_size += patlen;
491  memcpy(p->cs, pat, patlen);
492  }
493  }
494 
495  /* put in the pattern hash */
496  if (MpmInitHashAdd(mpm_ctx, p) != 0)
497  goto error;
498 
499  mpm_ctx->pattern_cnt++;
500 
501  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
502  if (depth) {
503  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
504  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
505  } else {
506  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
507  mpm_ctx->maxdepth = 0;
508  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
509  }
510  }
511 
512  if (mpm_ctx->maxlen < patlen)
513  mpm_ctx->maxlen = patlen;
514 
515  if (mpm_ctx->minlen == 0) {
516  mpm_ctx->minlen = patlen;
517  } else {
518  if (mpm_ctx->minlen > patlen)
519  mpm_ctx->minlen = patlen;
520  }
521 
522  /* we need the max pat id */
523  if (p->id > mpm_ctx->max_pat_id)
524  mpm_ctx->max_pat_id = p->id;
525 
526  p->sids_size = 1;
527  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
528  BUG_ON(p->sids == NULL);
529  p->sids[0] = sid;
530  } else {
531  /* we can be called multiple times for the same sid in the case
532  * of the 'single' modus. Here multiple rule groups share the
533  * same mpm ctx and might be adding the same pattern to the
534  * mpm_ctx */
535  int found = 0;
536  uint32_t x = 0;
537  for (x = 0; x < p->sids_size; x++) {
538  if (p->sids[x] == sid) {
539  found = 1;
540  break;
541  }
542  }
543 
544  if (!found) {
545  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
546  BUG_ON(sids == NULL);
547  p->sids = sids;
548  p->sids[p->sids_size] = sid;
549  p->sids_size++;
550  }
551  }
552 
553  return 0;
554 
555 error:
556  MpmFreePattern(mpm_ctx, p);
557  return -1;
558 }
559 
560 
561 /************************************Unittests*********************************/
562 
563 #ifdef UNITTESTS
564 #endif /* UNITTESTS */
565 
567 {
568 #ifdef UNITTESTS
569  uint16_t i;
570 
571  for (i = 0; i < MPM_TABLE_SIZE; i++) {
572  if (i == MPM_NOTSET)
573  continue;
574 
575  g_ut_modules++;
576 
577  if (mpm_table[i].RegisterUnittests != NULL) {
578  g_ut_covered++;
580  } else {
581  if (coverage_unittests)
582  SCLogWarning("mpm module %s has no "
583  "unittest registration function.",
584  mpm_table[i].name);
585  }
586  }
587 
588 #endif
589 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:198
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:91
detect-engine.h
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:149
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:171
g_ut_modules
int g_ut_modules
Definition: suricata.c:878
MpmThreadCtx_
Definition: util-mpm.h:47
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:352
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:159
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
util-mpm-ac-ks.h
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:566
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:787
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:104
g_ut_covered
int g_ut_covered
Definition: suricata.c:879
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:165
MpmCtxFactoryItem::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:118
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:101
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:164
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:49
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:857
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:68
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:95
MAX
#define MAX(x, y)
Definition: suricata-common.h:384
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:148
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:59
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:203
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:215
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:106
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem::name
const char * name
Definition: util-mpm.h:117
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:116
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:80
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:133
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:144
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:74
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:33
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:127
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:100
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:77
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:86
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto)
Register a new Mpm Context.
Definition: util-mpm.c:60
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:30
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:55
MpmCtxFactoryItem::sm_list
int32_t sm_list
Definition: util-mpm.h:121
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:218
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:244
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:87
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1461
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:72
ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
#define ENGINE_SGH_MPM_FACTORY_CONTEXT_START_ID_RANGE
Definition: detect.h:998
MpmCtxFactoryItem::next
struct MpmCtxFactoryItem * next
Definition: util-mpm.h:123
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:133
MpmACBSRegister
void MpmACBSRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac-bs.c:97
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:41
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:98
util-mpm-ac-bs.h
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:62
FatalError
#define FatalError(...)
Definition: util-debug.h:502
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:78
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:65
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:150
MpmCtxFactoryItem
Definition: util-mpm.h:116
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:114
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1197
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:128
MpmCtxFactoryItem::alproto
AppProto alproto
Definition: util-mpm.h:122
MpmCtxFactoryItem::id
int32_t id
Definition: util-mpm.h:120
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:103
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:109
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:57
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
MpmCtxFactoryItem::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:119
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:430
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:129
coverage_unittests
int coverage_unittests
Definition: suricata.c:877
MpmCtx_
Definition: util-mpm.h:89
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:70
SigIntId
#define SigIntId
Definition: suricata-common.h:304
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:93
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
MpmTableElmt_
Definition: util-mpm.h:146
MpmHSRegister
void MpmHSRegister(void)
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:253
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:170
MpmCtxFactoryContainer_
Definition: util-mpm.h:126