suricata
util-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __UTIL_MPM_H__
25 #define __UTIL_MPM_H__
26 
27 #include "util-prefilter.h"
28 
29 #define MPM_INIT_HASH_SIZE 65536
30 
31 enum {
33 
34  /* aho-corasick */
39  /* table size */
41 };
42 
43 /* Internal Pattern Index: 0 to pattern_cnt-1 */
44 typedef uint32_t MpmPatternIndex;
45 
46 typedef struct MpmThreadCtx_ {
47  void *ctx;
48 
49  uint32_t memory_cnt;
50  uint32_t memory_size;
51 
52 } MpmThreadCtx;
53 
54 typedef struct MpmPattern_ {
55  /* length of the pattern */
56  uint16_t len;
57  /* flags decribing the pattern */
58  uint8_t flags;
59 
60  /* offset into the buffer where match may start */
61  uint16_t offset;
62 
63  /* offset into the buffer before which match much complete */
64  uint16_t depth;
65 
66  /* holds the original pattern that was added */
67  uint8_t *original_pat;
68  /* case sensitive */
69  uint8_t *cs;
70  /* case INsensitive */
71  uint8_t *ci;
72  /* pattern id */
73  uint32_t id;
74 
75  /* sid(s) for this pattern */
76  uint32_t sids_size;
78 
79  struct MpmPattern_ *next;
80 } MpmPattern;
81 
82 typedef struct MpmCtx_ {
83  void *ctx;
84  uint16_t mpm_type;
85 
86  /* Indicates if this a global mpm_ctx. Global mpm_ctx is the one that
87  * is instantiated when we use "single". Non-global is "full", i.e.
88  * one per sgh. We are using a uint16_t here to avoiding using a pad.
89  * You can use a uint8_t here as well. */
90  uint16_t global;
91 
92  /* unique patterns */
93  uint32_t pattern_cnt;
94 
95  uint16_t minlen;
96  uint16_t maxlen;
97 
98  uint32_t memory_cnt;
99  uint32_t memory_size;
100 
101  uint32_t max_pat_id;
102 
103  /* hash used during ctx initialization */
105 } MpmCtx;
106 
107 /* if we want to retrieve an unique mpm context from the mpm context factory
108  * we should supply this as the key */
109 #define MPM_CTX_FACTORY_UNIQUE_CONTEXT -1
110 
111 typedef struct MpmCtxFactoryItem_ {
112  const char *name;
115  int32_t id;
117 
118 typedef struct MpmCtxFactoryContainer_ {
120  int32_t no_of_items;
122 
123 /** pattern is case insensitive */
124 #define MPM_PATTERN_FLAG_NOCASE 0x01
125 /** pattern is negated */
126 #define MPM_PATTERN_FLAG_NEGATED 0x02
127 /** pattern has a depth setting */
128 #define MPM_PATTERN_FLAG_DEPTH 0x04
129 /** pattern has an offset setting */
130 #define MPM_PATTERN_FLAG_OFFSET 0x08
131 /** one byte pattern (used in b2g) */
132 #define MPM_PATTERN_ONE_BYTE 0x10
133 /** the ctx uses it's own internal id instead of
134  * what is passed through the API */
135 #define MPM_PATTERN_CTX_OWNS_ID 0x20
136 
137 typedef struct MpmTableElmt_ {
138  const char *name;
139  void (*InitCtx)(struct MpmCtx_ *);
140  void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
141  void (*DestroyCtx)(struct MpmCtx_ *);
142  void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
143 
144  /** function pointers for adding patterns to the mpm ctx.
145  *
146  * \param mpm_ctx Mpm context to add the pattern to
147  * \param pattern pointer to the pattern
148  * \param pattern_len length of the pattern in bytes
149  * \param offset pattern offset setting
150  * \param depth pattern depth setting
151  * \param pid pattern id
152  * \param sid signature _internal_ id
153  * \param flags pattern flags
154  */
155  int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
156  int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
157  int (*Prepare)(struct MpmCtx_ *);
158  uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t);
159  void (*PrintCtx)(struct MpmCtx_ *);
160  void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
161  void (*RegisterUnittests)(void);
162  uint8_t flags;
163 } MpmTableElmt;
164 
167 
168 struct DetectEngineCtx_;
169 
170 int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *);
171 void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *);
172 MpmCtx *MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int);
174 int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *);
175 
180 
181 void MpmTableSetup(void);
182 void MpmRegisterTests(void);
183 
184 void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher);
185 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t);
186 
187 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
188  uint16_t offset, uint16_t depth,
189  uint32_t pid, SigIntId sid, uint8_t flags);
190 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
191  uint16_t offset, uint16_t depth,
192  uint32_t pid, SigIntId sid, uint8_t flags);
193 
194 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p);
195 
196 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
197  uint16_t offset, uint16_t depth, uint32_t pid,
198  SigIntId sid, uint8_t flags);
199 
200 #endif /* __UTIL_MPM_H__ */
uint16_t flags
int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *)
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:319
uint16_t minlen
Definition: util-mpm.h:95
void PmqCleanup(PrefilterRuleStore *)
Cleanup a Pmq.
uint8_t flags
Definition: util-mpm.h:162
uint32_t pattern_cnt
Definition: util-mpm.h:93
int PmqSetup(PrefilterRuleStore *)
Setup a pmq.
uint32_t MpmPatternIndex
Definition: util-mpm.h:44
uint64_t offset
uint16_t global
Definition: util-mpm.h:90
struct MpmTableElmt_ MpmTableElmt
uint32_t memory_cnt
Definition: util-mpm.h:98
uint32_t memory_size
Definition: util-mpm.h:50
struct MpmPattern_ * next
Definition: util-mpm.h:79
int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *)
Register a new Mpm Context.
Definition: util-mpm.c:55
main detection engine ctx
Definition: detect.h:720
void PmqFree(PrefilterRuleStore *)
Cleanup and free a Pmq.
struct MpmPattern_ MpmPattern
SigIntId * sids
Definition: util-mpm.h:77
uint16_t depth
Definition: util-mpm.h:64
struct MpmThreadCtx_ MpmThreadCtx
uint16_t mpm_type
Definition: util-mpm.h:84
void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *)
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:113
void MpmRegisterTests(void)
Definition: util-mpm.c:621
struct MpmCtxFactoryItem_ MpmCtxFactoryItem
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:418
uint32_t id
Definition: util-mpm.h:73
uint16_t offset
Definition: util-mpm.h:61
uint32_t memory_size
Definition: util-mpm.h:99
uint32_t memory_cnt
Definition: util-mpm.h:49
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:261
struct MpmCtxFactoryContainer_ MpmCtxFactoryContainer
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:496
uint8_t * cs
Definition: util-mpm.h:69
int mpm_default_matcher
Definition: util-mpm.h:166
MpmCtx * MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int)
uint16_t maxlen
Definition: util-mpm.h:96
void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *)
Definition: util-mpm.c:229
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.h:165
MpmCtxFactoryItem * items
Definition: util-mpm.h:119
MpmPattern ** init_hash
Definition: util-mpm.h:104
structure for storing potential rule matches
uint32_t sids_size
Definition: util-mpm.h:76
uint8_t flags
Definition: util-mpm.h:58
void MpmTableSetup(void)
Definition: util-mpm.c:284
uint32_t max_pat_id
Definition: util-mpm.h:101
const char * name
Definition: util-mpm.h:112
const char * name
Definition: util-mpm.h:138
void * ctx
Definition: util-mpm.h:83
uint8_t * ci
Definition: util-mpm.h:71
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:310
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:114
uint16_t len
Definition: util-mpm.h:56
struct MpmCtx_ MpmCtx
#define SigIntId
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: util-mpm.c:256
void PmqReset(PrefilterRuleStore *)
Reset a Pmq for reusage. Meant to be called after a single search.
uint8_t * original_pat
Definition: util-mpm.h:67
void * ctx
Definition: util-mpm.h:47