suricata
util-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_UTIL_MPM_H
25 #define SURICATA_UTIL_MPM_H
26 
27 #include "app-layer-protos.h"
28 // forward declaration for bindgen
29 #define SigIntId uint32_t
31 
32 #define MPM_INIT_HASH_SIZE 65536
33 
34 enum {
36 
37  /* aho-corasick */
41  /* table size */
43 };
44 
45 /* Internal Pattern Index: 0 to pattern_cnt-1 */
46 typedef uint32_t MpmPatternIndex;
47 
48 typedef struct MpmThreadCtx_ {
49  void *ctx;
50 
51  uint32_t memory_cnt;
52  uint32_t memory_size;
53 
55 
56 typedef struct MpmPattern_ {
57  /* length of the pattern */
58  uint16_t len;
59  /* flags describing the pattern */
60  uint8_t flags;
61 
62  /* offset into the buffer where match may start */
63  uint16_t offset;
64 
65  /* offset into the buffer before which match much complete */
66  uint16_t depth;
67 
68  /* holds the original pattern that was added */
69  uint8_t *original_pat;
70  /* case sensitive */
71  uint8_t *cs;
72  /* case insensitive */
73  uint8_t *ci;
74  /* pattern id */
75  uint32_t id;
76 
77  /* sid(s) for this pattern */
78  uint32_t sids_size;
80 
81  struct MpmPattern_ *next;
83 
84 /* Indicates if this a global mpm_ctx. Global mpm_ctx is the one that
85  * is instantiated when we use "single". Non-global is "full", i.e.
86  * one per sgh. */
87 #define MPMCTX_FLAGS_GLOBAL BIT_U8(0)
88 #define MPMCTX_FLAGS_NODEPTH BIT_U8(1)
89 #define MPMCTX_FLAGS_CACHE_TO_DISK BIT_U8(2)
90 
91 typedef struct MpmConfig_ {
92  const char *cache_dir_path;
94 
95 typedef struct MpmCtx_ {
96  void *ctx;
97  uint8_t mpm_type;
98 
99  uint8_t flags;
100 
101  uint16_t maxdepth;
102 
103  /* unique patterns */
104  uint32_t pattern_cnt;
105 
106  uint16_t minlen;
107  uint16_t maxlen;
108 
109  uint32_t memory_cnt;
110  uint32_t memory_size;
111 
112  uint32_t max_pat_id;
113 
114  /* hash used during ctx initialization */
117 
118 /* if we want to retrieve an unique mpm context from the mpm context factory
119  * we should supply this as the key */
120 #define MPM_CTX_FACTORY_UNIQUE_CONTEXT -1
121 
122 typedef struct MpmCtxFactoryItem {
123  const char *name;
126  int32_t id;
127  int32_t sm_list;
128  AppProto alproto; /**< ALPROTO_UNKNOWN is not an app item */
131 
132 typedef struct MpmCtxFactoryContainer_ {
134  int32_t max_id;
136 
137 /** pattern is case insensitive */
138 #define MPM_PATTERN_FLAG_NOCASE 0x01
139 /** pattern has a depth setting */
140 #define MPM_PATTERN_FLAG_DEPTH 0x04
141 /** pattern has an offset setting */
142 #define MPM_PATTERN_FLAG_OFFSET 0x08
143 /** the ctx uses it's own internal id instead of
144  * what is passed through the API */
145 #define MPM_PATTERN_CTX_OWNS_ID 0x20
146 #define MPM_PATTERN_FLAG_ENDSWITH 0x40
147 
148 #define MPM_FEATURE_FLAG_DEPTH BIT_U8(0)
149 #define MPM_FEATURE_FLAG_OFFSET BIT_U8(1)
150 #define MPM_FEATURE_FLAG_ENDSWITH BIT_U8(2)
151 
152 typedef struct MpmTableElmt_ {
153  const char *name;
154  void (*InitCtx)(struct MpmCtx_ *);
155  void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
156  void (*DestroyCtx)(struct MpmCtx_ *);
157  void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
158 
159  MpmConfig *(*ConfigInit)(void);
160  void (*ConfigDeinit)(MpmConfig **);
161  void (*ConfigCacheDirSet)(MpmConfig *, const char *dir_path);
162 
163  /** function pointers for adding patterns to the mpm ctx.
164  *
165  * \param mpm_ctx Mpm context to add the pattern to
166  * \param pattern pointer to the pattern
167  * \param pattern_len length of the pattern in bytes
168  * \param offset pattern offset setting
169  * \param depth pattern depth setting
170  * \param pid pattern id
171  * \param sid signature _internal_ id
172  * \param flags pattern flags
173  */
174  int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
175  int (*AddPatternNocase)(struct MpmCtx_ *, const uint8_t *, uint16_t, uint16_t, uint16_t,
176  uint32_t, SigIntId, uint8_t);
177  int (*Prepare)(MpmConfig *, struct MpmCtx_ *);
179  /** \retval cnt number of patterns that matches: once per pattern max. */
180  uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t);
181  void (*PrintCtx)(struct MpmCtx_ *);
182  void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
183 #ifdef UNITTESTS
184  void (*RegisterUnittests)(void);
185 #endif
186  uint8_t feature_flags;
188 
190 extern uint8_t mpm_default_matcher;
191 
192 struct DetectEngineCtx_;
193 
195  struct DetectEngineCtx_ *, const char *, const int, const AppProto);
199 int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *);
200 
201 void MpmTableSetup(void);
202 void MpmRegisterTests(void);
203 
204 void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher);
205 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t);
206 void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher);
207 
208 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
209  uint16_t offset, uint16_t depth,
210  uint32_t pid, SigIntId sid, uint8_t flags);
211 int SCMpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset,
212  uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags);
213 
214 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p);
215 
216 int MpmAddPattern(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset,
217  uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags);
218 
219 #endif /* SURICATA_UTIL_MPM_H */
MpmTableElmt_::PrintThreadCtx
void(* PrintThreadCtx)(struct MpmThreadCtx_ *)
Definition: util-mpm.h:182
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:97
MpmPatternIndex
uint32_t MpmPatternIndex
Definition: util-mpm.h:46
MPM_AC
@ MPM_AC
Definition: util-mpm.h:38
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:155
MpmThreadCtx_
Definition: util-mpm.h:48
MpmTableElmt_::name
const char * name
Definition: util-mpm.h:153
PrefilterRuleStore_
structure for storing potential rule matches
Definition: util-prefilter.h:34
MpmConfig
struct MpmConfig_ MpmConfig
SigIntId
#define SigIntId
Definition: util-mpm.h:29
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
MpmThreadCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:51
MpmCtxFactoryContainer
struct MpmCtxFactoryContainer_ MpmCtxFactoryContainer
MpmTableElmt
struct MpmTableElmt_ MpmTableElmt
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:249
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:110
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:435
SCMpmAddPatternCI
int SCMpmAddPatternCI(MpmCtx *mpm_ctx, const uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:258
MpmCtxFactoryItem::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:124
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:107
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:174
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
MpmTableElmt_::feature_flags
uint8_t feature_flags
Definition: util-mpm.h:186
MpmCtxFactoryItem
struct MpmCtxFactoryItem MpmCtxFactoryItem
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:69
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:101
MpmThreadCtx
struct MpmThreadCtx_ MpmThreadCtx
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:154
MpmConfig_::cache_dir_path
const char * cache_dir_path
Definition: util-mpm.h:92
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:60
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: util-mpm.c:195
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:35
MpmTableElmt_::PrintCtx
void(* PrintCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:181
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:112
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:224
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem::name
const char * name
Definition: util-mpm.h:123
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:81
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:75
MpmThreadCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:52
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *)
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:133
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:106
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:78
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:353
MpmTableElmt_::CacheRuleset
int(* CacheRuleset)(MpmConfig *)
Definition: util-mpm.h:178
MpmPattern_
Definition: util-mpm.h:56
MpmCtxFactoryItem::sm_list
int32_t sm_list
Definition: util-mpm.h:127
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:180
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:73
MpmCtxFactoryItem::next
struct MpmCtxFactoryItem * next
Definition: util-mpm.h:129
flags
uint8_t flags
Definition: decode-gre.h:0
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:104
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *)
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:42
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, const uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:175
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:63
MPM_AC_KS
@ MPM_AC_KS
Definition: util-mpm.h:39
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:79
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:570
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:66
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *)
Definition: util-mpm.c:168
MpmTableElmt_::Prepare
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
Definition: util-mpm.h:177
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:156
MpmCtxFactoryItem
Definition: util-mpm.h:122
MpmConfig_
Definition: util-mpm.h:91
MpmCtxFactoryItem::alproto
AppProto alproto
Definition: util-mpm.h:128
MpmCtxFactoryItem::id
int32_t id
Definition: util-mpm.h:126
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:109
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:115
MPM_HS
@ MPM_HS
Definition: util-mpm.h:40
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:58
app-layer-protos.h
MpmTableElmt_::ConfigDeinit
void(* ConfigDeinit)(MpmConfig **)
Definition: util-mpm.h:160
MpmCtxFactoryItem::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:125
MpmTableElmt_::ConfigCacheDirSet
void(* ConfigCacheDirSet)(MpmConfig *, const char *dir_path)
Definition: util-mpm.h:161
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *, const int, const AppProto)
Register a new Mpm Context.
Definition: util-mpm.c:59
MpmCtx
struct MpmCtx_ MpmCtx
MpmTableElmt_::DestroyThreadCtx
void(* DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:157
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:134
MpmCtx_
Definition: util-mpm.h:95
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:71
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:99
MpmTableElmt_
Definition: util-mpm.h:152
MpmCtx_::ctx
void * ctx
Definition: util-mpm.h:96
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:209
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int)
MpmThreadCtx_::ctx
void * ctx
Definition: util-mpm.h:49
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:184
MpmCtxFactoryContainer_
Definition: util-mpm.h:132
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:202