suricata
util-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_UTIL_MPM_H
25 #define SURICATA_UTIL_MPM_H
26 
27 #include "app-layer-protos.h"
28 #include "util-prefilter.h"
29 
30 #define MPM_INIT_HASH_SIZE 65536
31 
32 enum {
34 
35  /* aho-corasick */
39  /* table size */
41 };
42 
43 /* Internal Pattern Index: 0 to pattern_cnt-1 */
44 typedef uint32_t MpmPatternIndex;
45 
46 typedef struct MpmThreadCtx_ {
47  void *ctx;
48 
49  uint32_t memory_cnt;
50  uint32_t memory_size;
51 
53 
54 typedef struct MpmPattern_ {
55  /* length of the pattern */
56  uint16_t len;
57  /* flags describing the pattern */
58  uint8_t flags;
59 
60  /* offset into the buffer where match may start */
61  uint16_t offset;
62 
63  /* offset into the buffer before which match much complete */
64  uint16_t depth;
65 
66  /* holds the original pattern that was added */
67  uint8_t *original_pat;
68  /* case sensitive */
69  uint8_t *cs;
70  /* case insensitive */
71  uint8_t *ci;
72  /* pattern id */
73  uint32_t id;
74 
75  /* sid(s) for this pattern */
76  uint32_t sids_size;
78 
79  struct MpmPattern_ *next;
81 
82 /* Indicates if this a global mpm_ctx. Global mpm_ctx is the one that
83  * is instantiated when we use "single". Non-global is "full", i.e.
84  * one per sgh. */
85 #define MPMCTX_FLAGS_GLOBAL BIT_U8(0)
86 #define MPMCTX_FLAGS_NODEPTH BIT_U8(1)
87 #define MPMCTX_FLAGS_CACHE_TO_DISK BIT_U8(2)
88 
89 typedef struct MpmConfig_ {
90  const char *cache_dir_path;
92 
93 typedef struct MpmCtx_ {
94  void *ctx;
95  uint8_t mpm_type;
96 
97  uint8_t flags;
98 
99  uint16_t maxdepth;
100 
101  /* unique patterns */
102  uint32_t pattern_cnt;
103 
104  uint16_t minlen;
105  uint16_t maxlen;
106 
107  uint32_t memory_cnt;
108  uint32_t memory_size;
109 
110  uint32_t max_pat_id;
111 
112  /* hash used during ctx initialization */
115 
116 /* if we want to retrieve an unique mpm context from the mpm context factory
117  * we should supply this as the key */
118 #define MPM_CTX_FACTORY_UNIQUE_CONTEXT -1
119 
120 typedef struct MpmCtxFactoryItem {
121  const char *name;
124  int32_t id;
125  int32_t sm_list;
126  AppProto alproto; /**< ALPROTO_UNKNOWN is not an app item */
129 
130 typedef struct MpmCtxFactoryContainer_ {
132  int32_t max_id;
134 
135 /** pattern is case insensitive */
136 #define MPM_PATTERN_FLAG_NOCASE 0x01
137 /** pattern has a depth setting */
138 #define MPM_PATTERN_FLAG_DEPTH 0x04
139 /** pattern has an offset setting */
140 #define MPM_PATTERN_FLAG_OFFSET 0x08
141 /** the ctx uses it's own internal id instead of
142  * what is passed through the API */
143 #define MPM_PATTERN_CTX_OWNS_ID 0x20
144 #define MPM_PATTERN_FLAG_ENDSWITH 0x40
145 
146 #define MPM_FEATURE_FLAG_DEPTH BIT_U8(0)
147 #define MPM_FEATURE_FLAG_OFFSET BIT_U8(1)
148 #define MPM_FEATURE_FLAG_ENDSWITH BIT_U8(2)
149 
150 typedef struct MpmTableElmt_ {
151  const char *name;
152  void (*InitCtx)(struct MpmCtx_ *);
153  void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
154  void (*DestroyCtx)(struct MpmCtx_ *);
155  void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
156 
157  MpmConfig *(*ConfigInit)(void);
158  void (*ConfigDeinit)(MpmConfig **);
159  void (*ConfigCacheDirSet)(MpmConfig *, const char *dir_path);
160 
161  /** function pointers for adding patterns to the mpm ctx.
162  *
163  * \param mpm_ctx Mpm context to add the pattern to
164  * \param pattern pointer to the pattern
165  * \param pattern_len length of the pattern in bytes
166  * \param offset pattern offset setting
167  * \param depth pattern depth setting
168  * \param pid pattern id
169  * \param sid signature _internal_ id
170  * \param flags pattern flags
171  */
172  int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
173  int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
174  int (*Prepare)(MpmConfig *, struct MpmCtx_ *);
176  /** \retval cnt number of patterns that matches: once per pattern max. */
177  uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t);
178  void (*PrintCtx)(struct MpmCtx_ *);
179  void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
180 #ifdef UNITTESTS
181  void (*RegisterUnittests)(void);
182 #endif
183  uint8_t feature_flags;
185 
187 extern uint8_t mpm_default_matcher;
188 
189 struct DetectEngineCtx_;
190 
192  struct DetectEngineCtx_ *, const char *, const int, const AppProto);
196 int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *);
197 
198 void MpmTableSetup(void);
199 void MpmRegisterTests(void);
200 
201 void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher);
202 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t);
203 void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher);
204 
205 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
206  uint16_t offset, uint16_t depth,
207  uint32_t pid, SigIntId sid, uint8_t flags);
208 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
209  uint16_t offset, uint16_t depth,
210  uint32_t pid, SigIntId sid, uint8_t flags);
211 
212 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p);
213 
214 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
215  uint16_t offset, uint16_t depth, uint32_t pid,
216  SigIntId sid, uint8_t flags);
217 
218 #endif /* SURICATA_UTIL_MPM_H */
MpmTableElmt_::PrintThreadCtx
void(* PrintThreadCtx)(struct MpmThreadCtx_ *)
Definition: util-mpm.h:179
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:95
MpmPatternIndex
uint32_t MpmPatternIndex
Definition: util-mpm.h:44
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
MpmTableElmt_::InitThreadCtx
void(* InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:153
MpmThreadCtx_
Definition: util-mpm.h:46
MPM_AC_KS
@ MPM_AC_KS
Definition: util-mpm.h:37
MpmAddPattern
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:438
MpmTableElmt_::name
const char * name
Definition: util-mpm.h:151
PrefilterRuleStore_
structure for storing potential rule matches
Definition: util-prefilter.h:34
MpmConfig
struct MpmConfig_ MpmConfig
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
MpmThreadCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:49
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:258
MpmCtxFactoryContainer
struct MpmCtxFactoryContainer_ MpmCtxFactoryContainer
MpmTableElmt
struct MpmTableElmt_ MpmTableElmt
MpmAddPatternCS
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:249
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:860
MpmCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:108
MpmTableElmt_::AddPatternNocase
int(* AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:173
MpmCtxFactoryItem::mpm_ctx_ts
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:122
MpmCtx_::maxlen
uint16_t maxlen
Definition: util-mpm.h:105
MpmTableElmt_::AddPattern
int(* AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t)
Definition: util-mpm.h:172
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
MpmTableElmt_::feature_flags
uint8_t feature_flags
Definition: util-mpm.h:183
MPM_TABLE_SIZE
@ MPM_TABLE_SIZE
Definition: util-mpm.h:40
MpmCtxFactoryItem
struct MpmCtxFactoryItem MpmCtxFactoryItem
MpmPattern_::original_pat
uint8_t * original_pat
Definition: util-mpm.h:67
MpmCtx_::maxdepth
uint16_t maxdepth
Definition: util-mpm.h:99
MpmThreadCtx
struct MpmThreadCtx_ MpmThreadCtx
MpmTableElmt_::InitCtx
void(* InitCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:152
MpmConfig_::cache_dir_path
const char * cache_dir_path
Definition: util-mpm.h:90
MpmPattern_::flags
uint8_t flags
Definition: util-mpm.h:58
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: util-mpm.c:195
MpmTableElmt_::PrintCtx
void(* PrintCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:178
MpmCtx_::max_pat_id
uint32_t max_pat_id
Definition: util-mpm.h:110
MpmTableSetup
void MpmTableSetup(void)
Definition: util-mpm.c:224
MpmPattern
struct MpmPattern_ MpmPattern
MpmCtxFactoryItem::name
const char * name
Definition: util-mpm.h:121
MPM_HS
@ MPM_HS
Definition: util-mpm.h:38
MpmPattern_::next
struct MpmPattern_ * next
Definition: util-mpm.h:79
MpmPattern_::id
uint32_t id
Definition: util-mpm.h:73
MpmThreadCtx_::memory_size
uint32_t memory_size
Definition: util-mpm.h:50
MpmFactoryIsMpmCtxAvailable
int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *)
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
MpmCtxFactoryContainer_::items
MpmCtxFactoryItem * items
Definition: util-mpm.h:131
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:104
MpmPattern_::sids_size
uint32_t sids_size
Definition: util-mpm.h:76
MpmFreePattern
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:356
MPM_NOTSET
@ MPM_NOTSET
Definition: util-mpm.h:33
MpmTableElmt_::CacheRuleset
int(* CacheRuleset)(MpmConfig *)
Definition: util-mpm.h:175
MpmPattern_
Definition: util-mpm.h:54
MpmCtxFactoryItem::sm_list
int32_t sm_list
Definition: util-mpm.h:125
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:177
MpmPattern_::ci
uint8_t * ci
Definition: util-mpm.h:71
MpmCtxFactoryItem::next
struct MpmCtxFactoryItem * next
Definition: util-mpm.h:127
util-prefilter.h
flags
uint8_t flags
Definition: decode-gre.h:0
MpmCtx_::pattern_cnt
uint32_t pattern_cnt
Definition: util-mpm.h:102
MpmFactoryReClaimMpmCtx
void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *)
MpmPattern_::offset
uint16_t offset
Definition: util-mpm.h:61
MpmPattern_::sids
SigIntId * sids
Definition: util-mpm.h:77
MpmRegisterTests
void MpmRegisterTests(void)
Definition: util-mpm.c:574
MpmPattern_::depth
uint16_t depth
Definition: util-mpm.h:64
MpmFactoryDeRegisterAllMpmCtxProfiles
void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *)
Definition: util-mpm.c:168
MpmTableElmt_::Prepare
int(* Prepare)(MpmConfig *, struct MpmCtx_ *)
Definition: util-mpm.h:174
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:154
MpmCtxFactoryItem
Definition: util-mpm.h:120
MpmConfig_
Definition: util-mpm.h:89
MpmCtxFactoryItem::alproto
AppProto alproto
Definition: util-mpm.h:126
MpmCtxFactoryItem::id
int32_t id
Definition: util-mpm.h:124
MpmCtx_::memory_cnt
uint32_t memory_cnt
Definition: util-mpm.h:107
MpmCtx_::init_hash
MpmPattern ** init_hash
Definition: util-mpm.h:113
MpmPattern_::len
uint16_t len
Definition: util-mpm.h:56
app-layer-protos.h
MpmTableElmt_::ConfigDeinit
void(* ConfigDeinit)(MpmConfig **)
Definition: util-mpm.h:158
MpmCtxFactoryItem::mpm_ctx_tc
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:123
MpmTableElmt_::ConfigCacheDirSet
void(* ConfigCacheDirSet)(MpmConfig *, const char *dir_path)
Definition: util-mpm.h:159
MpmFactoryRegisterMpmCtxProfile
int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *, const int, const AppProto)
Register a new Mpm Context.
Definition: util-mpm.c:59
MpmCtx
struct MpmCtx_ MpmCtx
MpmTableElmt_::DestroyThreadCtx
void(* DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *)
Definition: util-mpm.h:155
MpmCtxFactoryContainer_::max_id
int32_t max_id
Definition: util-mpm.h:132
MPM_AC
@ MPM_AC
Definition: util-mpm.h:36
MpmCtx_
Definition: util-mpm.h:93
MpmPattern_::cs
uint8_t * cs
Definition: util-mpm.h:69
SigIntId
#define SigIntId
Definition: suricata-common.h:324
MpmCtx_::flags
uint8_t flags
Definition: util-mpm.h:97
MpmTableElmt_
Definition: util-mpm.h:150
MpmCtx_::ctx
void * ctx
Definition: util-mpm.h:94
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:209
MpmFactoryGetMpmCtxForProfile
MpmCtx * MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int)
MpmThreadCtx_::ctx
void * ctx
Definition: util-mpm.h:47
MpmTableElmt_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: util-mpm.h:181
MpmCtxFactoryContainer_
Definition: util-mpm.h:130
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:202