suricata
util-mpm.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Pattern matcher utility Functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-mpm.h"
28 #include "util-debug.h"
29 
30 /* include pattern matchers */
31 #include "util-mpm-ac.h"
32 #include "util-mpm-ac-bs.h"
33 #include "util-mpm-ac-ks.h"
34 #include "util-mpm-hs.h"
35 #include "util-hashlist.h"
36 
37 #include "detect-engine.h"
38 #include "util-misc.h"
39 #include "conf.h"
40 #include "conf-yaml-loader.h"
41 #include "queue.h"
42 #include "util-unittest.h"
43 #include "util-memcpy.h"
44 #ifdef BUILD_HYPERSCAN
45 #include "hs.h"
46 #endif
47 
50 
51 /**
52  * \brief Register a new Mpm Context.
53  *
54  * \param name A new profile to be registered to store this MpmCtx.
55  *
56  * \retval id Return the id created for the new MpmCtx profile.
57  */
59 {
60  void *ptmp;
61  /* the very first entry */
62  if (de_ctx->mpm_ctx_factory_container == NULL) {
64  if (de_ctx->mpm_ctx_factory_container == NULL) {
65  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
66  exit(EXIT_FAILURE);
67  }
69 
71  if (unlikely(item == NULL)) {
72  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
73  exit(EXIT_FAILURE);
74  }
75 
76  item[0].name = name;
77 
78  /* toserver */
79  item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
80  if (item[0].mpm_ctx_ts == NULL) {
81  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
82  exit(EXIT_FAILURE);
83  }
84  memset(item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
86 
87  /* toclient */
88  item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
89  if (item[0].mpm_ctx_tc == NULL) {
90  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
91  exit(EXIT_FAILURE);
92  }
93  memset(item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
95 
96  /* our id starts from 0 always. Helps us with the ctx retrieval from
97  * the array */
98  item[0].id = 0;
99 
100  /* store the newly created item */
103 
104  /* the first id is always 0 */
105  return item[0].id;
106  } else {
107  int i;
109  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
110  if (items[i].name != NULL && strcmp(items[i].name, name) == 0) {
111  /* looks like we have this mpm_ctx freed */
112  if (items[i].mpm_ctx_ts == NULL) {
113  items[i].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
114  if (items[i].mpm_ctx_ts == NULL) {
115  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
116  exit(EXIT_FAILURE);
117  }
118  memset(items[i].mpm_ctx_ts, 0, sizeof(MpmCtx));
119  items[i].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
120  }
121  if (items[i].mpm_ctx_tc == NULL) {
122  items[i].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
123  if (items[i].mpm_ctx_tc == NULL) {
124  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
125  exit(EXIT_FAILURE);
126  }
127  memset(items[i].mpm_ctx_tc, 0, sizeof(MpmCtx));
128  items[i].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
129  }
130  return items[i].id;
131  }
132  }
133 
134  /* let's make the new entry */
135  ptmp = SCRealloc(items,
137  if (unlikely(ptmp == NULL)) {
138  SCFree(items);
139  items = NULL;
140  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
141  exit(EXIT_FAILURE);
142  }
143  items = ptmp;
144 
146 
148  new_item[0].name = name;
149 
150  /* toserver */
151  new_item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx));
152  if (new_item[0].mpm_ctx_ts == NULL) {
153  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
154  exit(EXIT_FAILURE);
155  }
156  memset(new_item[0].mpm_ctx_ts, 0, sizeof(MpmCtx));
157  new_item[0].mpm_ctx_ts->flags |= MPMCTX_FLAGS_GLOBAL;
158 
159  /* toclient */
160  new_item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx));
161  if (new_item[0].mpm_ctx_tc == NULL) {
162  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
163  exit(EXIT_FAILURE);
164  }
165  memset(new_item[0].mpm_ctx_tc, 0, sizeof(MpmCtx));
166  new_item[0].mpm_ctx_tc->flags |= MPMCTX_FLAGS_GLOBAL;
167 
170 
171  /* the newly created id */
172  return new_item[0].id;
173  }
174 }
175 
177 {
178  if (mpm_ctx == NULL)
179  return 0;
180 
181  if (de_ctx->mpm_ctx_factory_container == NULL) {
182  return 0;
183  } else {
184  int i;
185  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
186  if (mpm_ctx == de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_ts ||
188  return 1;
189  }
190  }
191  return 0;
192  }
193 }
194 
195 MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
196 {
197  if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) {
198  MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx));
199  if (unlikely(mpm_ctx == NULL)) {
200  SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
201  exit(EXIT_FAILURE);
202  }
203  memset(mpm_ctx, 0, sizeof(MpmCtx));
204  return mpm_ctx;
205  } else if (id < -1) {
206  SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument - %d\n", id);
207  return NULL;
208  } else if (id >= de_ctx->mpm_ctx_factory_container->no_of_items) {
209  /* this id does not exist */
210  return NULL;
211  } else {
212  return (direction == 0) ?
215  }
216 }
217 
219 {
220  if (mpm_ctx == NULL)
221  return;
222 
223  if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) {
224  if (mpm_ctx->mpm_type != MPM_NOTSET)
225  mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx);
226  SCFree(mpm_ctx);
227  }
228 
229  return;
230 }
231 
233 {
234  if (de_ctx->mpm_ctx_factory_container == NULL)
235  return;
236 
237  int i = 0;
239  for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) {
240  if (items[i].mpm_ctx_ts != NULL) {
241  if (items[i].mpm_ctx_ts->mpm_type != MPM_NOTSET)
242  mpm_table[items[i].mpm_ctx_ts->mpm_type].DestroyCtx(items[i].mpm_ctx_ts);
243  SCFree(items[i].mpm_ctx_ts);
244  }
245  if (items[i].mpm_ctx_tc != NULL) {
246  if (items[i].mpm_ctx_tc->mpm_type != MPM_NOTSET)
247  mpm_table[items[i].mpm_ctx_tc->mpm_type].DestroyCtx(items[i].mpm_ctx_tc);
248  SCFree(items[i].mpm_ctx_tc);
249  }
250  }
251 
255 
256  return;
257 }
258 
259 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
260 {
261  mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx);
262 }
263 
264 void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher)
265 {
266  mpm_ctx->mpm_type = matcher;
267  mpm_table[matcher].InitCtx(mpm_ctx);
268 }
269 
270 /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto".
271  * If Hyperscan is available, use it. Otherwise, use AC. */
272 #ifdef BUILD_HYPERSCAN
273 # define DEFAULT_MPM MPM_HS
274 # define DEFAULT_MPM_AC MPM_AC
275 #else
276 # define DEFAULT_MPM MPM_AC
277 #endif
278 
279 void MpmTableSetup(void)
280 {
281  memset(mpm_table, 0, sizeof(mpm_table));
283 
284  MpmACRegister();
285  MpmACBSRegister();
287 #ifdef BUILD_HYPERSCAN
288  #ifdef HAVE_HS_VALID_PLATFORM
289  /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if
290  * check is not successful. */
291  if (hs_valid_platform() != HS_SUCCESS) {
292  SCLogInfo("SSSE3 support not detected, disabling Hyperscan for "
293  "MPM");
294  /* Fall back to best Aho-Corasick variant. */
295  mpm_default_matcher = DEFAULT_MPM_AC;
296  } else {
297  MpmHSRegister();
298  }
299  #else
300  MpmHSRegister();
301  #endif /* HAVE_HS_VALID_PLATFORM */
302 #endif /* BUILD_HYPERSCAN */
303 }
304 
305 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
306  uint16_t offset, uint16_t depth,
307  uint32_t pid, SigIntId sid, uint8_t flags)
308 {
309  return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen,
310  offset, depth,
311  pid, sid, flags);
312 }
313 
314 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
315  uint16_t offset, uint16_t depth,
316  uint32_t pid, SigIntId sid, uint8_t flags)
317 {
318  return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen,
319  offset, depth,
320  pid, sid, flags);
321 }
322 
323 
324 /**
325  * \internal
326  * \brief Creates a hash of the pattern. We use it for the hashing process
327  * during the initial pattern insertion time, to cull duplicate sigs.
328  *
329  * \param pat Pointer to the pattern.
330  * \param patlen Pattern length.
331  *
332  * \retval hash A 32 bit unsigned hash.
333  */
334 static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen)
335 {
336  uint32_t hash = patlen * pat[0];
337  if (patlen > 1)
338  hash += pat[1];
339 
340  return (hash % MPM_INIT_HASH_SIZE);
341 }
342 
343 /**
344  * \internal
345  * \brief Looks up a pattern. We use it for the hashing process during the
346  * the initial pattern insertion time, to cull duplicate sigs.
347  *
348  * \param ctx Pointer to the AC ctx.
349  * \param pat Pointer to the pattern.
350  * \param patlen Pattern length.
351  * \param flags Flags. We don't need this.
352  *
353  * \retval hash A 32 bit unsigned hash.
354  */
355 static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx,
356  uint8_t *pat, uint16_t patlen,
357  uint16_t offset, uint16_t depth,
358  uint8_t flags, uint32_t pid)
359 {
360  uint32_t hash = MpmInitHashRaw(pat, patlen);
361 
362  if (ctx->init_hash == NULL) {
363  return NULL;
364  }
365 
366  MpmPattern *t = ctx->init_hash[hash];
367  for ( ; t != NULL; t = t->next) {
368  if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) {
369  if (t->id == pid)
370  return t;
371  } else {
372  if (t->len == patlen && t->offset == offset && t->depth == depth &&
373  memcmp(pat, t->original_pat, patlen) == 0 &&
374  t->flags == flags)
375  {
376  return t;
377  }
378  }
379  }
380 
381  return NULL;
382 }
383 
384 /**
385  * \internal
386  * \brief Allocs a new pattern instance.
387  *
388  * \param mpm_ctx Pointer to the mpm context.
389  *
390  * \retval p Pointer to the newly created pattern.
391  */
392 static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx)
393 {
394  MpmPattern *p = SCMalloc(sizeof(MpmPattern));
395  if (unlikely(p == NULL)) {
396  exit(EXIT_FAILURE);
397  }
398  memset(p, 0, sizeof(MpmPattern));
399 
400  mpm_ctx->memory_cnt++;
401  mpm_ctx->memory_size += sizeof(MpmPattern);
402 
403  return p;
404 }
405 
406 /**
407  * \internal
408  * \brief Used to free MpmPattern instances.
409  *
410  * \param mpm_ctx Pointer to the mpm context.
411  * \param p Pointer to the MpmPattern instance to be freed.
412  */
413 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
414 {
415  if (p != NULL && p->cs != NULL && p->cs != p->ci) {
416  SCFree(p->cs);
417  mpm_ctx->memory_cnt--;
418  mpm_ctx->memory_size -= p->len;
419  }
420 
421  if (p != NULL && p->ci != NULL) {
422  SCFree(p->ci);
423  mpm_ctx->memory_cnt--;
424  mpm_ctx->memory_size -= p->len;
425  }
426 
427  if (p != NULL && p->original_pat != NULL) {
428  SCFree(p->original_pat);
429  mpm_ctx->memory_cnt--;
430  mpm_ctx->memory_size -= p->len;
431  }
432 
433  if (p != NULL) {
434  SCFree(p);
435  mpm_ctx->memory_cnt--;
436  mpm_ctx->memory_size -= sizeof(MpmPattern);
437  }
438  return;
439 }
440 
441 static inline uint32_t MpmInitHash(MpmPattern *p)
442 {
443  uint32_t hash = p->len * p->original_pat[0];
444  if (p->len > 1)
445  hash += p->original_pat[1];
446 
447  return (hash % MPM_INIT_HASH_SIZE);
448 }
449 
450 static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p)
451 {
452  uint32_t hash = MpmInitHash(p);
453 
454  if (ctx->init_hash == NULL) {
455  return -1;
456  }
457 
458  if (ctx->init_hash[hash] == NULL) {
459  ctx->init_hash[hash] = p;
460  return 0;
461  }
462 
463  MpmPattern *tt = NULL;
464  MpmPattern *t = ctx->init_hash[hash];
465 
466  /* get the list tail */
467  do {
468  tt = t;
469  t = t->next;
470  } while (t != NULL);
471 
472  tt->next = p;
473 
474  return 0;
475 }
476 
477 /**
478  * \internal
479  * \brief Add a pattern to the mpm-ac context.
480  *
481  * \param mpm_ctx Mpm context.
482  * \param pat Pointer to the pattern.
483  * \param patlen Length of the pattern.
484  * \param pid Pattern id
485  * \param sid Signature id (internal id).
486  * \param flags Pattern's MPM_PATTERN_* flags.
487  *
488  * \retval 0 On success.
489  * \retval -1 On failure.
490  */
491 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
492  uint16_t offset, uint16_t depth, uint32_t pid,
493  SigIntId sid, uint8_t flags)
494 {
495  SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32,
496  mpm_ctx, patlen, pid);
497 
498  if (patlen == 0) {
499  SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0");
500  return 0;
501  }
502 
504  pid = UINT_MAX;
505 
506  /* check if we have already inserted this pattern */
507  MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen,
508  offset, depth, flags, pid);
509  if (p == NULL) {
510  SCLogDebug("Allocing new pattern");
511 
512  /* p will never be NULL */
513  p = MpmAllocPattern(mpm_ctx);
514 
515  p->len = patlen;
516  p->flags = flags;
517  p->offset = offset;
518  p->depth = depth;
520  p->id = mpm_ctx->max_pat_id++;
521  else
522  p->id = pid;
523 
524  p->original_pat = SCMalloc(patlen);
525  if (p->original_pat == NULL)
526  goto error;
527  mpm_ctx->memory_cnt++;
528  mpm_ctx->memory_size += patlen;
529  memcpy(p->original_pat, pat, patlen);
530 
531  p->ci = SCMalloc(patlen);
532  if (p->ci == NULL)
533  goto error;
534  mpm_ctx->memory_cnt++;
535  mpm_ctx->memory_size += patlen;
536  memcpy_tolower(p->ci, pat, patlen);
537 
538  /* setup the case sensitive part of the pattern */
539  if (p->flags & MPM_PATTERN_FLAG_NOCASE) {
540  /* nocase means no difference between cs and ci */
541  p->cs = p->ci;
542  } else {
543  if (memcmp(p->ci, pat, p->len) == 0) {
544  /* no diff between cs and ci: pat is lowercase */
545  p->cs = p->ci;
546  } else {
547  p->cs = SCMalloc(patlen);
548  if (p->cs == NULL)
549  goto error;
550  mpm_ctx->memory_cnt++;
551  mpm_ctx->memory_size += patlen;
552  memcpy(p->cs, pat, patlen);
553  }
554  }
555 
556  /* put in the pattern hash */
557  if (MpmInitHashAdd(mpm_ctx, p) != 0)
558  goto error;
559 
560  mpm_ctx->pattern_cnt++;
561 
562  if (!(mpm_ctx->flags & MPMCTX_FLAGS_NODEPTH)) {
563  if (depth) {
564  mpm_ctx->maxdepth = MAX(mpm_ctx->maxdepth, depth);
565  SCLogDebug("%p: depth %u max %u", mpm_ctx, depth, mpm_ctx->maxdepth);
566  } else {
567  mpm_ctx->flags |= MPMCTX_FLAGS_NODEPTH;
568  mpm_ctx->maxdepth = 0;
569  SCLogDebug("%p: alas, no depth for us", mpm_ctx);
570  }
571  }
572 
573  if (mpm_ctx->maxlen < patlen)
574  mpm_ctx->maxlen = patlen;
575 
576  if (mpm_ctx->minlen == 0) {
577  mpm_ctx->minlen = patlen;
578  } else {
579  if (mpm_ctx->minlen > patlen)
580  mpm_ctx->minlen = patlen;
581  }
582 
583  /* we need the max pat id */
584  if (p->id > mpm_ctx->max_pat_id)
585  mpm_ctx->max_pat_id = p->id;
586 
587  p->sids_size = 1;
588  p->sids = SCMalloc(p->sids_size * sizeof(SigIntId));
589  BUG_ON(p->sids == NULL);
590  p->sids[0] = sid;
591  } else {
592  /* we can be called multiple times for the same sid in the case
593  * of the 'single' modus. Here multiple rule groups share the
594  * same mpm ctx and might be adding the same pattern to the
595  * mpm_ctx */
596  int found = 0;
597  uint32_t x = 0;
598  for (x = 0; x < p->sids_size; x++) {
599  if (p->sids[x] == sid) {
600  found = 1;
601  break;
602  }
603  }
604 
605  if (!found) {
606  SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1)));
607  BUG_ON(sids == NULL);
608  p->sids = sids;
609  p->sids[p->sids_size] = sid;
610  p->sids_size++;
611  }
612  }
613 
614  return 0;
615 
616 error:
617  MpmFreePattern(mpm_ctx, p);
618  return -1;
619 }
620 
621 
622 /************************************Unittests*********************************/
623 
624 #ifdef UNITTESTS
625 #endif /* UNITTESTS */
626 
628 {
629 #ifdef UNITTESTS
630  uint16_t i;
631 
632  for (i = 0; i < MPM_TABLE_SIZE; i++) {
633  if (i == MPM_NOTSET)
634  continue;
635 
636  g_ut_modules++;
637 
638  if (mpm_table[i].RegisterUnittests != NULL) {
639  g_ut_covered++;
641  } else {
642  if (coverage_unittests)
643  SCLogWarning(SC_WARN_NO_UNITTESTS, "mpm module %s has no "
644  "unittest registration function.", mpm_table[i].name);
645  }
646  }
647 
648 #endif
649 }
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:259
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
MpmCtxFactoryItem_::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:144
util-hashlist.h
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx)
Definition: util-mpm.c:232
g_ut_modules
int g_ut_modules
Definition: suricata.c:834
MpmThreadCtx_
Definition: util-mpm.h:46
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:413
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx)
Definition: util-mpm.c:218
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
util-mpm-ac-ks.h
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:264
MpmCtxFactoryItem_::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:627
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:766
util-memcpy.h
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:103
g_ut_covered
int g_ut_covered
Definition: suricata.c:835
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:32
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:160
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:100
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:159
DetectEngineCtx_::mpm_ctx_factory_container
MpmCtxFactoryContainer * mpm_ctx_factory_container
Definition: detect.h:835
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:94
MAX
#define MAX(x, y)
Definition: suricata-common.h:381
SC_ERR_INVALID_ARGUMENTS
@ SC_ERR_INVALID_ARGUMENTS
Definition: util-error.h:82
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:143
util-unittest.h
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
MpmCtxFactoryItem_::name
const char * name
Definition: util-mpm.h:116
DEFAULT_MPM
#define DEFAULT_MPM
Definition: util-mpm.c:276
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:105
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem_::id
int32_t id
Definition: util-mpm.h:119
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx)
Definition: util-mpm.c:176
util-debug.h
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction)
Definition: util-mpm.c:195
MPM_PATTERN_CTX_OWNS_ID
#define MPM_PATTERN_CTX_OWNS_ID
Definition: util-mpm.h:139
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:123
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MPMCTX_FLAGS_GLOBAL
#define MPMCTX_FLAGS_GLOBAL
Definition: util-mpm.h:85
conf-yaml-loader.h
conf.h
MPM_INIT_HASH_SIZE
#define MPM_INIT_HASH_SIZE
Definition: util-mpm.h:29
MpmCtxFactoryItem_
Definition: util-mpm.h:115
queue.h
util-mpm-ac.h
MpmPattern_
Definition: util-mpm.h:54
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:279
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:305
MPMCTX_FLAGS_NODEPTH
#define MPMCTX_FLAGS_NODEPTH
Definition: util-mpm.h:86
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
MpmACTileRegister
void MpmACTileRegister(void)
Register the aho-corasick mpm 'ks' originally developed by Ken Steele for Tilera Tile-Gx processor.
Definition: util-mpm-ac-ks.c:1467
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
MPM_PATTERN_FLAG_NOCASE
#define MPM_PATTERN_FLAG_NOCASE
Definition: util-mpm.h:128
MpmACBSRegister
void MpmACBSRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac-bs.c:95
util-mpm.h
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:97
util-mpm-ac-bs.h
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:145
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
MPM_CTX_FACTORY_UNIQUE_CONTEXT
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT
Definition: util-mpm.h:113
MpmACRegister
void MpmACRegister(void)
Register the aho-corasick mpm.
Definition: util-mpm-ac.c:1239
MpmCtxFactoryContainer_::no_of_items
int32_t no_of_items
Definition: util-mpm.h:124
mpm_default_matcher
int mpm_default_matcher
Definition: util-mpm.c:49
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:102
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:108
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name)
Register a new Mpm Context.
Definition: util-mpm.c:58
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:48
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
util-mpm-hs.h
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:491
coverage_unittests
int coverage_unittests
Definition: suricata.c:833
MpmCtx_
Definition: util-mpm.h:88
util-misc.h
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:297
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:92
MpmTableElmt_
Definition: util-mpm.h:141
MpmHSRegister
void MpmHSRegister(void)
SC_WARN_NO_UNITTESTS
@ SC_WARN_NO_UNITTESTS
Definition: util-error.h:266
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:314
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:165
MpmCtxFactoryContainer_
Definition: util-mpm.h:122