suricata
util-spm.h File Reference
#include "util-spm-bs.h"
#include "util-spm-bs2bm.h"
#include "util-spm-bm.h"
Include dependency graph for util-spm.h:

Go to the source code of this file.

Data Structures

struct  SpmCtx_
 
struct  SpmGlobalThreadCtx_
 
struct  SpmThreadCtx_
 
struct  SpmTableElmt_
 

Macros

#define SpmSearch(text, textlen, needle, needlelen)
 
#define SpmNocaseSearch(text, textlen, needle, needlelen)
 

Typedefs

typedef struct SpmCtx_ SpmCtx
 
typedef struct SpmGlobalThreadCtx_ SpmGlobalThreadCtx
 
typedef struct SpmThreadCtx_ SpmThreadCtx
 
typedef struct SpmTableElmt_ SpmTableElmt
 

Enumerations

enum  { SPM_BM, SPM_HS, SPM_TABLE_SIZE }
 

Functions

uint16_t SinglePatternMatchDefaultMatcher (void)
 Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml. More...
 
void SpmTableSetup (void)
 
SpmGlobalThreadCtxSpmInitGlobalThreadCtx (uint16_t matcher)
 
void SpmDestroyGlobalThreadCtx (SpmGlobalThreadCtx *g_thread_ctx)
 
SpmThreadCtxSpmMakeThreadCtx (const SpmGlobalThreadCtx *g_thread_ctx)
 
void SpmDestroyThreadCtx (SpmThreadCtx *thread_ctx)
 
SpmCtxSpmInitCtx (const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *g_thread_ctx)
 
void SpmDestroyCtx (SpmCtx *ctx)
 
uint8_t * SpmScan (const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint32_t haystack_len)
 
uint8_t * Bs2bmSearch (const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
 Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array) More...
 
uint8_t * Bs2bmNocaseSearch (const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
 Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array) More...
 
uint8_t * BoyerMooreSearch (const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
 Search a pattern in the text using Boyer Moore algorithm (build a bad character shifts array and good prefixes shift array) More...
 
uint8_t * BoyerMooreNocaseSearch (const uint8_t *text, uint32_t textlen, uint8_t *needle, uint16_t needlelen)
 Search a pattern in the text using Boyer Moore nocase algorithm (build a bad character shifts array and good prefixes shift array) More...
 
void UtilSpmSearchRegistertests (void)
 

Variables

SpmTableElmt spm_table [SPM_TABLE_SIZE]
 

Detailed Description

Macro Definition Documentation

◆ SpmNocaseSearch

#define SpmNocaseSearch (   text,
  textlen,
  needle,
  needlelen 
)
Value:
({\
uint8_t *mfound; \
if (needlelen < 4 && textlen < 512) \
mfound = BasicSearchNocase(text, textlen, needle, needlelen); \
else if (needlelen < 4) \
mfound = BasicSearchNocase(text, textlen, needle, needlelen); \
else \
mfound = BoyerMooreNocaseSearch(text, textlen, needle, needlelen); \
mfound; \
})

Definition at line 113 of file util-spm.h.

◆ SpmSearch

#define SpmSearch (   text,
  textlen,
  needle,
  needlelen 
)
Value:
({\
uint8_t *mfound; \
if (needlelen < 4 && textlen < 512) \
mfound = BasicSearch(text, textlen, needle, needlelen); \
else if (needlelen < 4) \
mfound = BasicSearch(text, textlen, needle, needlelen); \
else \
mfound = BoyerMooreSearch(text, textlen, needle, needlelen); \
mfound; \
})

Definition at line 102 of file util-spm.h.

Typedef Documentation

◆ SpmCtx

typedef struct SpmCtx_ SpmCtx

Structure holding an immutable "built" SPM matcher (such as the Boyer-Moore tables, Hyperscan database etc) that is passed to the Scan call.

◆ SpmGlobalThreadCtx

Structure holding a global prototype for per-thread scratch space, passed to each InitCtx call.

◆ SpmTableElmt

typedef struct SpmTableElmt_ SpmTableElmt

◆ SpmThreadCtx

typedef struct SpmThreadCtx_ SpmThreadCtx

Structure holding some mutable per-thread space for use by a matcher at scan time. Constructed from SpmGlobalThreadCtx by the MakeThreadCtx call.

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
SPM_BM 
SPM_HS 
SPM_TABLE_SIZE 

Definition at line 31 of file util-spm.h.

Function Documentation

◆ BoyerMooreNocaseSearch()

uint8_t* BoyerMooreNocaseSearch ( const uint8_t *  text,
uint32_t  textlen,
uint8_t *  needle,
uint16_t  needlelen 
)

Search a pattern in the text using Boyer Moore nocase algorithm (build a bad character shifts array and good prefixes shift array)

Parameters
textText to search in
textlenlength of the text
needlepattern to search for
needlelenlength of the pattern

Definition at line 270 of file util-spm.c.

References BoyerMooreCtxDeInit(), BoyerMooreNocase(), and BoyerMooreNocaseCtxInit().

Here is the call graph for this function:

◆ BoyerMooreSearch()

uint8_t* BoyerMooreSearch ( const uint8_t *  text,
uint32_t  textlen,
const uint8_t *  needle,
uint16_t  needlelen 
)

Search a pattern in the text using Boyer Moore algorithm (build a bad character shifts array and good prefixes shift array)

Parameters
textText to search in
textlenlength of the text
needlepattern to search for
needlelenlength of the pattern

Definition at line 250 of file util-spm.c.

References BoyerMoore(), BoyerMooreCtxDeInit(), and BoyerMooreCtxInit().

Here is the call graph for this function:

◆ Bs2bmNocaseSearch()

uint8_t* Bs2bmNocaseSearch ( const uint8_t *  text,
uint32_t  textlen,
const uint8_t *  needle,
uint16_t  needlelen 
)

Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array)

Parameters
textText to search in
textlenlength of the text
needlepattern to search for
needlelenlength of the pattern

Definition at line 232 of file util-spm.c.

References ALPHABET_SIZE, Bs2BmBadchars(), and Bs2BmNocase().

Here is the call graph for this function:

◆ Bs2bmSearch()

uint8_t* Bs2bmSearch ( const uint8_t *  text,
uint32_t  textlen,
const uint8_t *  needle,
uint16_t  needlelen 
)

Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array)

Default algorithm to use: Boyer Moore

Wrappers for building context and searching (Bs2Bm and boyermoore) Use them if you cant store the context

Parameters
textText to search in
textlenlength of the text
needlepattern to search for
needlelenlength of the pattern

Definition at line 215 of file util-spm.c.

References ALPHABET_SIZE, Bs2Bm(), and Bs2BmBadchars().

Here is the call graph for this function:

◆ SinglePatternMatchDefaultMatcher()

uint16_t SinglePatternMatchDefaultMatcher ( void  )

Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml.

Definition at line 68 of file util-spm.c.

References ConfGet(), FatalError, SC_ERR_INVALID_VALUE, SC_ERR_INVALID_YAML_CONF_ENTRY, SCLogError, SCLogInfo, SPM_BM, SPM_HS, spm_table, and SPM_TABLE_SIZE.

Here is the call graph for this function:

◆ SpmDestroyCtx()

void SpmDestroyCtx ( SpmCtx ctx)

Definition at line 184 of file util-spm.c.

References BUG_ON, SpmTableElmt_::DestroyCtx, SpmCtx_::matcher, and spm_table.

Referenced by DetectContentFree().

Here is the caller graph for this function:

◆ SpmDestroyGlobalThreadCtx()

void SpmDestroyGlobalThreadCtx ( SpmGlobalThreadCtx g_thread_ctx)

Definition at line 145 of file util-spm.c.

References SpmTableElmt_::DestroyGlobalThreadCtx, SpmGlobalThreadCtx_::matcher, and spm_table.

Referenced by DetectEngineCtxFree().

Here is the caller graph for this function:

◆ SpmDestroyThreadCtx()

void SpmDestroyThreadCtx ( SpmThreadCtx thread_ctx)

Definition at line 164 of file util-spm.c.

References BUG_ON, SpmTableElmt_::DestroyThreadCtx, SpmThreadCtx_::matcher, and spm_table.

◆ SpmInitCtx()

SpmCtx* SpmInitCtx ( const uint8_t *  needle,
uint16_t  needle_len,
int  nocase,
SpmGlobalThreadCtx g_thread_ctx 
)

Definition at line 174 of file util-spm.c.

References BUG_ON, SpmTableElmt_::InitCtx, SpmGlobalThreadCtx_::matcher, and spm_table.

Referenced by DetectContentParse().

Here is the caller graph for this function:

◆ SpmInitGlobalThreadCtx()

SpmGlobalThreadCtx* SpmInitGlobalThreadCtx ( uint16_t  matcher)

Definition at line 139 of file util-spm.c.

References BUG_ON, SpmTableElmt_::InitGlobalThreadCtx, and spm_table.

◆ SpmMakeThreadCtx()

SpmThreadCtx* SpmMakeThreadCtx ( const SpmGlobalThreadCtx g_thread_ctx)

◆ SpmScan()

uint8_t* SpmScan ( const SpmCtx ctx,
SpmThreadCtx thread_ctx,
const uint8_t *  haystack,
uint32_t  haystack_len 
)

Definition at line 194 of file util-spm.c.

References SpmCtx_::matcher, SpmTableElmt_::Scan, and spm_table.

Referenced by DetectEngineContentInspection().

Here is the caller graph for this function:

◆ SpmTableSetup()

void SpmTableSetup ( void  )

Definition at line 123 of file util-spm.c.

References spm_table, SpmBMRegister(), and SpmHSRegister().

Referenced by ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ UtilSpmSearchRegistertests()

void UtilSpmSearchRegistertests ( void  )

Definition at line 2677 of file util-spm.c.

References UtRegisterTest().

Here is the call graph for this function:

Variable Documentation

◆ spm_table

BoyerMooreNocaseSearch
uint8_t * BoyerMooreNocaseSearch(const uint8_t *text, uint32_t textlen, uint8_t *needle, uint16_t needlelen)
Search a pattern in the text using Boyer Moore nocase algorithm (build a bad character shifts array a...
Definition: util-spm.c:270
BasicSearchNocase
uint8_t * BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len)
Basic search case less.
Definition: util-spm-bs.c:102
BoyerMooreSearch
uint8_t * BoyerMooreSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
Search a pattern in the text using Boyer Moore algorithm (build a bad character shifts array and good...
Definition: util-spm.c:250
BasicSearch
uint8_t * BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len)
Basic search improved. Limits are better handled, so it doesn't start searches that wont fit in the r...
Definition: util-spm-bs.c:48