util-spm.h File Reference

#include "util-spm-bs.h"

Include dependency graph for util-spm.h:

Go to the source code of this file.

Data Structures
struct	SpmCtx_
struct	SpmGlobalThreadCtx_
struct	SpmThreadCtx_
struct	SpmTableElmt_

Macros
#define	SpmSearch(text, textlen, needle, needlelen)
#define	SpmNocaseSearch(text, textlen, needle, needlelen)

Typedefs
typedef struct SpmCtx_	SpmCtx
typedef struct SpmGlobalThreadCtx_	SpmGlobalThreadCtx
typedef struct SpmThreadCtx_	SpmThreadCtx
typedef struct SpmTableElmt_	SpmTableElmt

Enumerations
enum	{ SPM_BM, SPM_HS, SPM_TABLE_SIZE }

Functions
uint8_t	SinglePatternMatchDefaultMatcher (void)
	Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml. More...
void	SpmTableSetup (void)
SpmGlobalThreadCtx *	SpmInitGlobalThreadCtx (uint8_t matcher)
void	SpmDestroyGlobalThreadCtx (SpmGlobalThreadCtx *g_thread_ctx)
SpmThreadCtx *	SpmMakeThreadCtx (const SpmGlobalThreadCtx *g_thread_ctx)
void	SpmDestroyThreadCtx (SpmThreadCtx *thread_ctx)
SpmCtx *	SpmInitCtx (const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *g_thread_ctx)
void	SpmDestroyCtx (SpmCtx *ctx)
uint8_t *	SpmScan (const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint32_t haystack_len)
uint8_t *	Bs2bmSearch (const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
	Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array) More...
uint8_t *	BoyerMooreSearch (const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen)
	Search a pattern in the text using Boyer Moore algorithm (build a bad character shifts array and good prefixes shift array) More...
uint8_t *	BoyerMooreNocaseSearch (const uint8_t *text, uint32_t textlen, uint8_t *needle, uint16_t needlelen)
	Search a pattern in the text using Boyer Moore nocase algorithm (build a bad character shifts array and good prefixes shift array) More...
void	UtilSpmSearchRegistertests (void)

Variables
SpmTableElmt	spm_table [SPM_TABLE_SIZE]

Detailed Description

Author

Pablo Rincon Crespo pablo.nosp@m..rin.nosp@m.con.c.nosp@m.resp.nosp@m.o@gma.nosp@m.il.c.nosp@m.om

Definition in file util-spm.h.

Macro Definition Documentation

SpmNocaseSearch

#define SpmNocaseSearch	(		text,
			textlen,
			needle,
			needlelen
	)

Value:

    ({\
    uint8_t *mfound; \
    if (needlelen < 4 && textlen < 512) \
          mfound = BasicSearchNocase(text, textlen, needle, needlelen); \
    else if (needlelen < 4) \
          mfound = BasicSearchNocase(text, textlen, needle, needlelen); \
    else \
          mfound = BoyerMooreNocaseSearch(text, textlen, needle, needlelen); \
    mfound; \
    })

Definition at line 111 of file util-spm.h.

SpmSearch

#define SpmSearch	(		text,
			textlen,
			needle,
			needlelen
	)

Value:

    ({\
    uint8_t *mfound; \
    if (needlelen < 4 && textlen < 512) \
          mfound = BasicSearch(text, textlen, needle, needlelen); \
    else if (needlelen < 4) \
          mfound = BasicSearch(text, textlen, needle, needlelen); \
    else \
          mfound = BoyerMooreSearch(text, textlen, needle, needlelen); \
    mfound; \
    })

Definition at line 100 of file util-spm.h.

Typedef Documentation

SpmCtx

typedef struct SpmCtx_ SpmCtx

Structure holding an immutable "built" SPM matcher (such as the Boyer-Moore tables, Hyperscan database etc) that is passed to the Scan call.

SpmGlobalThreadCtx

typedef struct SpmGlobalThreadCtx_ SpmGlobalThreadCtx

Structure holding a global prototype for per-thread scratch space, passed to each InitCtx call.

SpmTableElmt

typedef struct SpmTableElmt_ SpmTableElmt

SpmThreadCtx

typedef struct SpmThreadCtx_ SpmThreadCtx

Structure holding some mutable per-thread space for use by a matcher at scan time. Constructed from SpmGlobalThreadCtx by the MakeThreadCtx call.

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
SPM_BM
SPM_HS
SPM_TABLE_SIZE

Definition at line 29 of file util-spm.h.

Function Documentation

BoyerMooreNocaseSearch()

uint8_t* BoyerMooreNocaseSearch	(	const uint8_t *	text,
		uint32_t	textlen,
		uint8_t *	needle,
		uint16_t	needlelen
	)

Search a pattern in the text using Boyer Moore nocase algorithm (build a bad character shifts array and good prefixes shift array)

Parameters

text	Text to search in
textlen	length of the text
needle	pattern to search for
needlelen	length of the pattern

Definition at line 252 of file util-spm.c.

References BoyerMooreCtxDeInit(), BoyerMooreNocase(), and BoyerMooreNocaseCtxInit().

Here is the call graph for this function:

BoyerMooreSearch()

uint8_t* BoyerMooreSearch	(	const uint8_t *	text,
		uint32_t	textlen,
		const uint8_t *	needle,
		uint16_t	needlelen
	)

Search a pattern in the text using Boyer Moore algorithm (build a bad character shifts array and good prefixes shift array)

Parameters

text	Text to search in
textlen	length of the text
needle	pattern to search for
needlelen	length of the pattern

Definition at line 232 of file util-spm.c.

References BoyerMoore(), BoyerMooreCtxDeInit(), and BoyerMooreCtxInit().

Here is the call graph for this function:

Bs2bmSearch()

uint8_t* Bs2bmSearch	(	const uint8_t *	text,
		uint32_t	textlen,
		const uint8_t *	needle,
		uint16_t	needlelen
	)

Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array)

Default algorithm to use: Boyer Moore

Wrappers for building context and searching (Bs2Bm and boyermoore) Use them if you cant store the context

Parameters

text	Text to search in
textlen	length of the text
needle	pattern to search for
needlelen	length of the pattern

Definition at line 214 of file util-spm.c.

References ALPHABET_SIZE, Bs2Bm(), and Bs2BmBadchars().

Here is the call graph for this function:

SinglePatternMatchDefaultMatcher()

uint8_t SinglePatternMatchDefaultMatcher

(

void

)

Returns the single pattern matcher algorithm to be used, based on the spm-algo setting in yaml.

Definition at line 68 of file util-spm.c.

References FatalError, name, SCConfGet(), SCLogError, SCLogInfo, SPM_BM, SPM_HS, spm_table, and SPM_TABLE_SIZE.

Here is the call graph for this function:

SpmDestroyCtx()

void SpmDestroyCtx

(

SpmCtx *

ctx

)

Definition at line 183 of file util-spm.c.

References BUG_ON, ctx, SpmTableElmt_::DestroyCtx, and spm_table.

Referenced by DetectContentConvertToNocase(), and DetectContentFree().

Here is the caller graph for this function:

SpmDestroyGlobalThreadCtx()

void SpmDestroyGlobalThreadCtx

(

SpmGlobalThreadCtx *

g_thread_ctx

)

Definition at line 144 of file util-spm.c.

References SpmTableElmt_::DestroyGlobalThreadCtx, SpmGlobalThreadCtx_::matcher, and spm_table.

Referenced by DetectEngineCtxFree().

Here is the caller graph for this function:

SpmDestroyThreadCtx()

void SpmDestroyThreadCtx

(

SpmThreadCtx *

thread_ctx

)

Definition at line 163 of file util-spm.c.

References BUG_ON, SpmTableElmt_::DestroyThreadCtx, SpmThreadCtx_::matcher, and spm_table.

SpmInitCtx()

SpmCtx* SpmInitCtx	(	const uint8_t *	needle,
		uint16_t	needle_len,
		int	nocase,
		SpmGlobalThreadCtx *	g_thread_ctx
	)

Definition at line 173 of file util-spm.c.

References BUG_ON, SpmTableElmt_::InitCtx, SpmGlobalThreadCtx_::matcher, and spm_table.

Referenced by DetectContentConvertToNocase(), and DetectContentParse().

Here is the caller graph for this function:

SpmInitGlobalThreadCtx()

SpmGlobalThreadCtx* SpmInitGlobalThreadCtx

(

uint8_t

matcher

)

Definition at line 138 of file util-spm.c.

References BUG_ON, SpmTableElmt_::InitGlobalThreadCtx, and spm_table.

SpmMakeThreadCtx()

SpmThreadCtx* SpmMakeThreadCtx

(

const SpmGlobalThreadCtx *

g_thread_ctx

)

Definition at line 153 of file util-spm.c.

References BUG_ON, SpmTableElmt_::MakeThreadCtx, SpmGlobalThreadCtx_::matcher, and spm_table.

SpmScan()

uint8_t* SpmScan	(	const SpmCtx *	ctx,
		SpmThreadCtx *	thread_ctx,
		const uint8_t *	haystack,
		uint32_t	haystack_len
	)

Definition at line 193 of file util-spm.c.

References ctx, SpmTableElmt_::Scan, and spm_table.

SpmTableSetup()

void SpmTableSetup

(

void

)

Definition at line 122 of file util-spm.c.

References spm_table, SpmBMRegister(), and SpmHSRegister().

Referenced by ListAppLayerHooks(), ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

UtilSpmSearchRegistertests()

void UtilSpmSearchRegistertests

(

void

)

Definition at line 2657 of file util-spm.c.

References UtRegisterTest().

Here is the call graph for this function:

Variable Documentation

spm_table

SpmTableElmt spm_table[SPM_TABLE_SIZE]

Definition at line 62 of file util-spm.c.

Referenced by SinglePatternMatchDefaultMatcher(), SpmBMRegister(), SpmDestroyCtx(), SpmDestroyGlobalThreadCtx(), SpmDestroyThreadCtx(), SpmInitCtx(), SpmInitGlobalThreadCtx(), SpmMakeThreadCtx(), SpmScan(), and SpmTableSetup().