suricata
util-mpm.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __UTIL_MPM_H__
25 #define __UTIL_MPM_H__
26 
27 #include "util-prefilter.h"
28 
29 #define MPM_INIT_HASH_SIZE 65536
30 
31 enum {
33 
34  /* aho-corasick */
39  /* table size */
41 };
42 
43 /* Internal Pattern Index: 0 to pattern_cnt-1 */
44 typedef uint32_t MpmPatternIndex;
45 
46 typedef struct MpmThreadCtx_ {
47  void *ctx;
48 
49  uint32_t memory_cnt;
50  uint32_t memory_size;
51 
52 } MpmThreadCtx;
53 
54 typedef struct MpmPattern_ {
55  /* length of the pattern */
56  uint16_t len;
57  /* flags decribing the pattern */
58  uint8_t flags;
59 
60  /* offset into the buffer where match may start */
61  uint16_t offset;
62 
63  /* offset into the buffer before which match much complete */
64  uint16_t depth;
65 
66  /* holds the original pattern that was added */
67  uint8_t *original_pat;
68  /* case sensitive */
69  uint8_t *cs;
70  /* case INsensitive */
71  uint8_t *ci;
72  /* pattern id */
73  uint32_t id;
74 
75  /* sid(s) for this pattern */
76  uint32_t sids_size;
78 
79  struct MpmPattern_ *next;
80 } MpmPattern;
81 
82 /* Indicates if this a global mpm_ctx. Global mpm_ctx is the one that
83  * is instantiated when we use "single". Non-global is "full", i.e.
84  * one per sgh. */
85 #define MPMCTX_FLAGS_GLOBAL BIT_U8(0)
86 #define MPMCTX_FLAGS_NODEPTH BIT_U8(1)
87 
88 typedef struct MpmCtx_ {
89  void *ctx;
90  uint8_t mpm_type;
91 
92  uint8_t flags;
93 
94  uint16_t maxdepth;
95 
96  /* unique patterns */
97  uint32_t pattern_cnt;
98 
99  uint16_t minlen;
100  uint16_t maxlen;
101 
102  uint32_t memory_cnt;
103  uint32_t memory_size;
104 
105  uint32_t max_pat_id;
106 
107  /* hash used during ctx initialization */
109 } MpmCtx;
110 
111 /* if we want to retrieve an unique mpm context from the mpm context factory
112  * we should supply this as the key */
113 #define MPM_CTX_FACTORY_UNIQUE_CONTEXT -1
114 
115 typedef struct MpmCtxFactoryItem_ {
116  const char *name;
119  int32_t id;
121 
122 typedef struct MpmCtxFactoryContainer_ {
124  int32_t no_of_items;
126 
127 /** pattern is case insensitive */
128 #define MPM_PATTERN_FLAG_NOCASE 0x01
129 /** pattern is negated */
130 #define MPM_PATTERN_FLAG_NEGATED 0x02
131 /** pattern has a depth setting */
132 #define MPM_PATTERN_FLAG_DEPTH 0x04
133 /** pattern has an offset setting */
134 #define MPM_PATTERN_FLAG_OFFSET 0x08
135 /** one byte pattern (used in b2g) */
136 #define MPM_PATTERN_ONE_BYTE 0x10
137 /** the ctx uses it's own internal id instead of
138  * what is passed through the API */
139 #define MPM_PATTERN_CTX_OWNS_ID 0x20
140 
141 typedef struct MpmTableElmt_ {
142  const char *name;
143  void (*InitCtx)(struct MpmCtx_ *);
144  void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
145  void (*DestroyCtx)(struct MpmCtx_ *);
146  void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *);
147 
148  /** function pointers for adding patterns to the mpm ctx.
149  *
150  * \param mpm_ctx Mpm context to add the pattern to
151  * \param pattern pointer to the pattern
152  * \param pattern_len length of the pattern in bytes
153  * \param offset pattern offset setting
154  * \param depth pattern depth setting
155  * \param pid pattern id
156  * \param sid signature _internal_ id
157  * \param flags pattern flags
158  */
159  int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
160  int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
161  int (*Prepare)(struct MpmCtx_ *);
162  uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t);
163  void (*PrintCtx)(struct MpmCtx_ *);
164  void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
165  void (*RegisterUnittests)(void);
166  uint8_t flags;
167 } MpmTableElmt;
168 
171 
172 struct DetectEngineCtx_;
173 
174 int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *);
175 void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *);
176 MpmCtx *MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int);
178 int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *);
179 
184 
185 void MpmTableSetup(void);
186 void MpmRegisterTests(void);
187 
188 void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher);
189 void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t);
190 
191 int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
192  uint16_t offset, uint16_t depth,
193  uint32_t pid, SigIntId sid, uint8_t flags);
194 int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen,
195  uint16_t offset, uint16_t depth,
196  uint32_t pid, SigIntId sid, uint8_t flags);
197 
198 void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p);
199 
200 int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
201  uint16_t offset, uint16_t depth, uint32_t pid,
202  SigIntId sid, uint8_t flags);
203 
204 #endif /* __UTIL_MPM_H__ */
uint16_t flags
int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *)
uint8_t flags
Definition: util-mpm.h:92
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:311
uint16_t minlen
Definition: util-mpm.h:99
void PmqCleanup(PrefilterRuleStore *)
Cleanup a Pmq.
uint8_t flags
Definition: util-mpm.h:166
uint32_t pattern_cnt
Definition: util-mpm.h:97
int PmqSetup(PrefilterRuleStore *)
Setup a pmq.
uint32_t MpmPatternIndex
Definition: util-mpm.h:44
uint64_t offset
struct MpmTableElmt_ MpmTableElmt
uint32_t memory_cnt
Definition: util-mpm.h:102
uint32_t memory_size
Definition: util-mpm.h:50
struct MpmPattern_ * next
Definition: util-mpm.h:79
int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *)
Register a new Mpm Context.
Definition: util-mpm.c:55
main detection engine ctx
Definition: detect.h:761
void PmqFree(PrefilterRuleStore *)
Cleanup and free a Pmq.
struct MpmPattern_ MpmPattern
SigIntId * sids
Definition: util-mpm.h:77
uint16_t depth
Definition: util-mpm.h:64
uint16_t maxdepth
Definition: util-mpm.h:94
struct MpmThreadCtx_ MpmThreadCtx
uint8_t mpm_type
Definition: util-mpm.h:90
void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *)
MpmCtx * mpm_ctx_ts
Definition: util-mpm.h:117
void MpmRegisterTests(void)
Definition: util-mpm.c:624
struct MpmCtxFactoryItem_ MpmCtxFactoryItem
void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p)
Definition: util-mpm.c:410
uint32_t id
Definition: util-mpm.h:73
uint16_t offset
Definition: util-mpm.h:61
uint32_t memory_size
Definition: util-mpm.h:103
uint32_t memory_cnt
Definition: util-mpm.h:49
void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher)
Definition: util-mpm.c:261
struct MpmCtxFactoryContainer_ MpmCtxFactoryContainer
int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:488
uint8_t * cs
Definition: util-mpm.h:69
int mpm_default_matcher
Definition: util-mpm.h:170
MpmCtx * MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int)
uint16_t maxlen
Definition: util-mpm.h:100
void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *)
Definition: util-mpm.c:229
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.h:169
MpmCtxFactoryItem * items
Definition: util-mpm.h:123
MpmPattern ** init_hash
Definition: util-mpm.h:108
structure for storing potential rule matches
uint32_t sids_size
Definition: util-mpm.h:76
uint8_t flags
Definition: util-mpm.h:58
void MpmTableSetup(void)
Definition: util-mpm.c:276
uint32_t max_pat_id
Definition: util-mpm.h:105
const char * name
Definition: util-mpm.h:116
const char * name
Definition: util-mpm.h:142
void * ctx
Definition: util-mpm.h:89
uint8_t * ci
Definition: util-mpm.h:71
int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:302
MpmCtx * mpm_ctx_tc
Definition: util-mpm.h:118
uint16_t len
Definition: util-mpm.h:56
struct MpmCtx_ MpmCtx
#define SigIntId
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t)
Definition: util-mpm.c:256
void PmqReset(PrefilterRuleStore *)
Reset a Pmq for reusage. Meant to be called after a single search.
uint8_t * original_pat
Definition: util-mpm.h:67
void * ctx
Definition: util-mpm.h:47