suricata
util-mpm.h File Reference
#include "util-prefilter.h"
Include dependency graph for util-mpm.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  MpmThreadCtx_
 
struct  MpmPattern_
 
struct  MpmCtx_
 
struct  MpmCtxFactoryItem_
 
struct  MpmCtxFactoryContainer_
 
struct  MpmTableElmt_
 

Macros

#define MPM_INIT_HASH_SIZE   65536
 
#define MPMCTX_FLAGS_GLOBAL   BIT_U8(0)
 
#define MPMCTX_FLAGS_NODEPTH   BIT_U8(1)
 
#define MPM_CTX_FACTORY_UNIQUE_CONTEXT   -1
 
#define MPM_PATTERN_FLAG_NOCASE   0x01
 
#define MPM_PATTERN_FLAG_NEGATED   0x02
 
#define MPM_PATTERN_FLAG_DEPTH   0x04
 
#define MPM_PATTERN_FLAG_OFFSET   0x08
 
#define MPM_PATTERN_ONE_BYTE   0x10
 
#define MPM_PATTERN_CTX_OWNS_ID   0x20
 

Typedefs

typedef uint32_t MpmPatternIndex
 
typedef struct MpmThreadCtx_ MpmThreadCtx
 
typedef struct MpmPattern_ MpmPattern
 
typedef struct MpmCtx_ MpmCtx
 
typedef struct MpmCtxFactoryItem_ MpmCtxFactoryItem
 
typedef struct MpmCtxFactoryContainer_ MpmCtxFactoryContainer
 
typedef struct MpmTableElmt_ MpmTableElmt
 

Enumerations

enum  {
  MPM_NOTSET = 0, MPM_AC, MPM_AC_BS, MPM_AC_KS,
  MPM_HS, MPM_TABLE_SIZE
}
 

Functions

int32_t MpmFactoryRegisterMpmCtxProfile (struct DetectEngineCtx_ *, const char *)
 Register a new Mpm Context. More...
 
void MpmFactoryReClaimMpmCtx (const struct DetectEngineCtx_ *, MpmCtx *)
 
MpmCtxMpmFactoryGetMpmCtxForProfile (const struct DetectEngineCtx_ *, int32_t, int)
 
void MpmFactoryDeRegisterAllMpmCtxProfiles (struct DetectEngineCtx_ *)
 
int32_t MpmFactoryIsMpmCtxAvailable (const struct DetectEngineCtx_ *, const MpmCtx *)
 
int PmqSetup (PrefilterRuleStore *)
 Setup a pmq. More...
 
void PmqReset (PrefilterRuleStore *)
 Reset a Pmq for reusage. Meant to be called after a single search. More...
 
void PmqCleanup (PrefilterRuleStore *)
 Cleanup a Pmq. More...
 
void PmqFree (PrefilterRuleStore *)
 Cleanup and free a Pmq. More...
 
void MpmTableSetup (void)
 
void MpmRegisterTests (void)
 
void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher)
 
void MpmInitThreadCtx (MpmThreadCtx *mpm_thread_ctx, uint16_t)
 
int MpmAddPatternCS (struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
 
int MpmAddPatternCI (struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
 
void MpmFreePattern (MpmCtx *mpm_ctx, MpmPattern *p)
 
int MpmAddPattern (MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
 

Variables

MpmTableElmt mpm_table [MPM_TABLE_SIZE]
 
int mpm_default_matcher
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file util-mpm.h.

Macro Definition Documentation

#define MPM_CTX_FACTORY_UNIQUE_CONTEXT   -1
#define MPM_PATTERN_CTX_OWNS_ID   0x20

the ctx uses it's own internal id instead of what is passed through the API

Definition at line 139 of file util-mpm.h.

Referenced by MpmAddPattern(), MpmAddPatternCI(), and PatternStrength().

#define MPM_PATTERN_FLAG_DEPTH   0x04

pattern has a depth setting

Definition at line 132 of file util-mpm.h.

#define MPM_PATTERN_FLAG_NEGATED   0x02

pattern is negated

Definition at line 130 of file util-mpm.h.

#define MPM_PATTERN_FLAG_NOCASE   0x01
#define MPM_PATTERN_FLAG_OFFSET   0x08

pattern has an offset setting

Definition at line 134 of file util-mpm.h.

#define MPM_PATTERN_ONE_BYTE   0x10

one byte pattern (used in b2g)

Definition at line 136 of file util-mpm.h.

#define MPMCTX_FLAGS_GLOBAL   BIT_U8(0)

Definition at line 85 of file util-mpm.h.

Referenced by MpmFactoryRegisterMpmCtxProfile(), and RetrieveFPForSig().

#define MPMCTX_FLAGS_NODEPTH   BIT_U8(1)

Definition at line 86 of file util-mpm.h.

Referenced by MpmAddPattern().

Typedef Documentation

typedef struct MpmCtx_ MpmCtx
typedef struct MpmPattern_ MpmPattern
typedef uint32_t MpmPatternIndex

Definition at line 44 of file util-mpm.h.

typedef struct MpmTableElmt_ MpmTableElmt
typedef struct MpmThreadCtx_ MpmThreadCtx

Enumeration Type Documentation

anonymous enum
Enumerator
MPM_NOTSET 
MPM_AC 
MPM_AC_BS 
MPM_AC_KS 
MPM_HS 
MPM_TABLE_SIZE 

Definition at line 31 of file util-mpm.h.

Function Documentation

int MpmAddPatternCI ( struct MpmCtx_ mpm_ctx,
uint8_t *  pat,
uint16_t  patlen,
uint16_t  offset,
uint16_t  depth,
uint32_t  pid,
SigIntId  sid,
uint8_t  flags 
)
int MpmAddPatternCS ( struct MpmCtx_ mpm_ctx,
uint8_t *  pat,
uint16_t  patlen,
uint16_t  offset,
uint16_t  depth,
uint32_t  pid,
SigIntId  sid,
uint8_t  flags 
)

Definition at line 302 of file util-mpm.c.

References MpmTableElmt_::AddPattern, mpm_table, and MpmCtx_::mpm_type.

Referenced by MpmACRegister(), MpmACTileRegister(), PatternStrength(), and SCACBSPrintInfo().

Here is the caller graph for this function:

MpmCtx* MpmFactoryGetMpmCtxForProfile ( const struct DetectEngineCtx_ ,
int32_t  ,
int   
)
int32_t MpmFactoryIsMpmCtxAvailable ( const struct DetectEngineCtx_ ,
const MpmCtx  
)
void MpmFactoryReClaimMpmCtx ( const struct DetectEngineCtx_ ,
MpmCtx  
)
int32_t MpmFactoryRegisterMpmCtxProfile ( DetectEngineCtx de_ctx,
const char *  name 
)

Register a new Mpm Context.

Parameters
nameA new profile to be registered to store this MpmCtx.
Return values
idReturn the id created for the new MpmCtx profile.

Definition at line 55 of file util-mpm.c.

References MpmCtx_::flags, MpmCtxFactoryItem_::id, MpmCtxFactoryContainer_::items, DetectEngineCtx_::mpm_ctx_factory_container, MpmCtxFactoryItem_::mpm_ctx_tc, MpmCtxFactoryItem_::mpm_ctx_ts, MPMCTX_FLAGS_GLOBAL, MpmCtxFactoryItem_::name, MpmCtxFactoryContainer_::no_of_items, SC_ERR_MEM_ALLOC, SCFree, SCLogError, SCMalloc, SCRealloc, and unlikely.

Referenced by DetectMpmPrepareAppMpms(), and DetectMpmSetupAppMpms().

Here is the caller graph for this function:

void MpmInitCtx ( MpmCtx mpm_ctx,
uint16_t  matcher 
)

Definition at line 261 of file util-mpm.c.

References MpmTableElmt_::InitCtx, mpm_table, and MpmCtx_::mpm_type.

Referenced by AppLayerProtoDetectSetup(), MpmACRegister(), MpmACTileRegister(), MpmStoreFree(), SCACBSPrintInfo(), and SMTPStateAlloc().

Here is the caller graph for this function:

void MpmInitThreadCtx ( MpmThreadCtx mpm_thread_ctx,
uint16_t   
)

Definition at line 256 of file util-mpm.c.

References MpmTableElmt_::InitThreadCtx, and mpm_table.

Referenced by PatternMatchThreadPrepare(), and SMTPStateAlloc().

Here is the caller graph for this function:

void MpmTableSetup ( void  )

Definition at line 276 of file util-mpm.c.

References DEFAULT_MPM, mpm_default_matcher, mpm_table, MpmACBSRegister(), MpmACRegister(), MpmACTileRegister(), MpmHSRegister(), and SCLogInfo.

Referenced by ListAppLayerProtocols(), ListKeywords(), PostRunDeinit(), RegisterAllModules(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

void PmqCleanup ( PrefilterRuleStore pmq)

Cleanup a Pmq.

Parameters
pmqPattern matcher queue to be cleaned up.

Definition at line 113 of file util-prefilter.c.

References PrefilterRuleStore_::rule_id_array, and SCFree.

Referenced by PmqFree().

Here is the caller graph for this function:

void PmqFree ( PrefilterRuleStore pmq)

Cleanup and free a Pmq.

Parameters
pmqPattern matcher queue to be free'd.

Definition at line 126 of file util-prefilter.c.

References PmqCleanup().

Referenced by AppLayerProtoDetectDestroyCtxThread(), DetectEngineThreadCtxInit(), MpmACRegister(), MpmACTileRegister(), SCACBSPrintInfo(), and SMTPStateAlloc().

Here is the call graph for this function:

Here is the caller graph for this function:

void PmqReset ( PrefilterRuleStore pmq)

Reset a Pmq for reusage. Meant to be called after a single search.

Parameters
pmqPattern matcher to be reset.
Todo:
memset is expensive, but we need it as we merge pmq's. We might use a flag so we can clear pmq's the old way if we can.

Definition at line 101 of file util-prefilter.c.

References PrefilterRuleStore_::rule_id_array_cnt.

Referenced by PacketPatternCleanup(), and SMTPProcessDataChunk().

Here is the caller graph for this function:

int PmqSetup ( PrefilterRuleStore pmq)

Setup a pmq.

Parameters
pmqPattern matcher queue to be initialized
Return values
-1error
0ok

Definition at line 36 of file util-prefilter.c.

References PrefilterRuleStore_::rule_id_array, PrefilterRuleStore_::rule_id_array_cnt, PrefilterRuleStore_::rule_id_array_size, SCEnter, SCMalloc, SCReturnInt, and SigIntId.

Referenced by AppLayerProtoDetectGetCtxThread(), DetectEngineResetMaxSigId(), MpmACRegister(), MpmACTileRegister(), SCACBSPrintInfo(), and SMTPStateAlloc().

Here is the caller graph for this function:

Variable Documentation