From: Victor Julien Date: Mon, 5 Oct 2015 17:15:58 +0000 (+0200) Subject: detect: use mpm store for app layer mpms X-Git-Tag: suricata-3.1RC1~362 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=102a82fc7bc47b7cf3c4c20bfbbd5da8363f987e;p=thirdparty%2Fsuricata.git detect: use mpm store for app layer mpms Rework app-layer mpm setup and registration to make this possible. --- diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 4c37958e05..6bed2e556e 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -71,10 +71,77 @@ const char *builtin_mpms[] = { NULL }; +typedef struct AppLayerMpms_ { + const char *name; + int32_t sgh_mpm_context; /**< mpm factory id */ + int direction; /**< SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT */ + int sm_list; + uint32_t flags; /**< flags set to SGH when this mpm is present */ + int id; /**< index into this array and result arrays */ +} AppLayerMpms; + +AppLayerMpms app_mpms[] = { + { "http_uri", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_UMATCH, SIG_GROUP_HEAD_MPM_URI, 0 }, + { "http_raw_uri", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRUDMATCH, SIG_GROUP_HEAD_MPM_HRUD, 1 }, + + { "http_header", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHDMATCH, SIG_GROUP_HEAD_MPM_HHD, 2}, + { "http_header", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HHDMATCH, SIG_GROUP_HEAD_MPM_HHD, 3}, + + { "http_user_agent", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HUADMATCH, SIG_GROUP_HEAD_MPM_HUAD, 4}, + + { "http_raw_header", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, 5}, + { "http_raw_header", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, 6}, + + { "http_method", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HMDMATCH, SIG_GROUP_HEAD_MPM_HMD, 7}, + + { "file_data", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_FD_SMTP, 8}, /* smtp */ + { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_HSBD, 9}, /* http server body */ + + { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, SIG_GROUP_HEAD_MPM_HSMD, 10}, + { "http_stat_code", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSCDMATCH, SIG_GROUP_HEAD_MPM_HSCD, 11}, + + { "http_client_body", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCBDMATCH, SIG_GROUP_HEAD_MPM_HCBD, 12}, + + { "http_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH, SIG_GROUP_HEAD_MPM_HHHD, 13}, + { "http_raw_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, SIG_GROUP_HEAD_MPM_HRHHD, 14}, + + { "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, 15}, + { "http_cookie", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, 16}, + + { "dns_query", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSQUERYNAME_MATCH, SIG_GROUP_HEAD_MPM_DNSQUERY, 17}, + + { NULL, 0, 0, 0, 0, 0, } +}; + +void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx) +{ + int i; + for (i = 0; i < APP_MPMS_MAX; i++) { + AppLayerMpms *am = &app_mpms[i]; -#define POPULATE_MPM_AVOID_PACKET_MPM_PATTERNS 0x01 -#define POPULATE_MPM_AVOID_STREAM_MPM_PATTERNS 0x02 -#define POPULATE_MPM_AVOID_URI_MPM_PATTERNS 0x04 + am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, am->name, + MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); + + SCLogDebug("AppLayer MPM %s: %u", am->name, am->sgh_mpm_context); + } +} + +void DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx) +{ + int i; + for (i = 0; i < APP_MPMS_MAX; i++) { + AppLayerMpms *am = &app_mpms[i]; + + int dir = (am->direction == SIG_FLAG_TOSERVER) ? 1 : 0; + + MpmCtx *mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, am->sgh_mpm_context, dir); + if (mpm_ctx != NULL) { + if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { + mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); + } + } + } +} /** * \brief check if a signature has patterns that are to be inspected @@ -1162,252 +1229,6 @@ static void PopulateMpmHelperAddPatternToPktCtx(MpmCtx *mpm_ctx, #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER) #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT) -static void PopulateMpmAddPatternToMpm(const DetectEngineCtx *de_ctx, - SigGroupHead *sgh, Signature *s, - SigMatch *mpm_sm) -{ - s->mpm_sm = mpm_sm; - - if (mpm_sm == NULL) { - SCLogDebug("%"PRIu32" no mpm pattern selected", s->id); - return; - } - - int sm_list = SigMatchListSMBelongsTo(s, mpm_sm); - if (sm_list == -1) - BUG_ON(SigMatchListSMBelongsTo(s, mpm_sm) == -1); - - uint8_t flags = 0; - - DetectContentData *cd = NULL; - - switch (sm_list) { - case DETECT_SM_LIST_PMATCH: - { - BUG_ON(1); - break; - } /* case DETECT_CONTENT */ - - case DETECT_SM_LIST_UMATCH: - case DETECT_SM_LIST_HRUDMATCH: - case DETECT_SM_LIST_HCBDMATCH: - case DETECT_SM_LIST_FILEDATA: - case DETECT_SM_LIST_HHDMATCH: - case DETECT_SM_LIST_HRHDMATCH: - case DETECT_SM_LIST_HMDMATCH: - case DETECT_SM_LIST_HCDMATCH: - case DETECT_SM_LIST_HSMDMATCH: - case DETECT_SM_LIST_HSCDMATCH: - case DETECT_SM_LIST_HUADMATCH: - case DETECT_SM_LIST_HHHDMATCH: - case DETECT_SM_LIST_HRHHDMATCH: - case DETECT_SM_LIST_DNSQUERYNAME_MATCH: - { - MpmCtx *mpm_ctx_ts = NULL; - MpmCtx *mpm_ctx_tc = NULL; - - cd = (DetectContentData *)mpm_sm->ctx; - - if (sm_list == DETECT_SM_LIST_UMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_uri_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_URI; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HCBDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hcbd_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HCBD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_FILEDATA) { - if (s->flags & SIG_FLAG_TOCLIENT) { - mpm_ctx_tc = sgh->mpm_hsbd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HSBD; - } - if (s->flags & SIG_FLAG_TOSERVER) { - mpm_ctx_ts = sgh->mpm_smtp_filedata_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_FD_SMTP; - } - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HHDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hhd_ctx_ts; - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = sgh->mpm_hhd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HHD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HRHDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hrhd_ctx_ts; - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = sgh->mpm_hrhd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HRHD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HMDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hmd_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HMD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HCDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hcd_ctx_ts; - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = sgh->mpm_hcd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HCD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HRUDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hrud_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HRUD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HSMDMATCH) { - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = sgh->mpm_hsmd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HSMD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HSCDMATCH) { - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = sgh->mpm_hscd_ctx_tc; - sgh->flags |= SIG_GROUP_HEAD_MPM_HSCD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HUADMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_huad_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HUAD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HHHDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hhhd_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HHHD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_HRHHDMATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_hrhhd_ctx_ts; - sgh->flags |= SIG_GROUP_HEAD_MPM_HRHHD; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } else if (sm_list == DETECT_SM_LIST_DNSQUERYNAME_MATCH) { - if (s->flags & SIG_FLAG_TOSERVER) - mpm_ctx_ts = sgh->mpm_dnsquery_ctx_ts; - if (s->flags & SIG_FLAG_TOCLIENT) - mpm_ctx_tc = NULL; - sgh->flags |= SIG_GROUP_HEAD_MPM_DNSQUERY; - s->flags |= SIG_FLAG_MPM_APPLAYER; - if (cd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; - } - - if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - if (DETECT_CONTENT_IS_SINGLE(cd) && - !(cd->flags & DETECT_CONTENT_NEGATED) && - !(cd->flags & DETECT_CONTENT_REPLACE) && - cd->content_len == cd->fp_chop_len) { - cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED; - } - - /* add the content to the mpm */ - if (cd->flags & DETECT_CONTENT_NOCASE) { - if (mpm_ctx_ts != NULL) { - MpmAddPatternCI(mpm_ctx_ts, - cd->content + cd->fp_chop_offset, cd->fp_chop_len, - 0, 0, - cd->id, s->num, flags); - } - if (mpm_ctx_tc != NULL) { - MpmAddPatternCI(mpm_ctx_tc, - cd->content + cd->fp_chop_offset, cd->fp_chop_len, - 0, 0, - cd->id, s->num, flags); - } - } else { - if (mpm_ctx_ts != NULL) { - MpmAddPatternCS(mpm_ctx_ts, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } - if (mpm_ctx_tc != NULL) { - MpmAddPatternCS(mpm_ctx_tc, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } - } - } else { - if (DETECT_CONTENT_IS_SINGLE(cd) && - !(cd->flags & DETECT_CONTENT_NEGATED) && - !(cd->flags & DETECT_CONTENT_REPLACE)) { - cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED; - } - - /* add the content to the "uri" mpm */ - if (cd->flags & DETECT_CONTENT_NOCASE) { - if (mpm_ctx_ts != NULL) { - MpmAddPatternCI(mpm_ctx_ts, - cd->content, cd->content_len, - 0, 0, - cd->id, s->num, flags); - } - if (mpm_ctx_tc != NULL) { - MpmAddPatternCI(mpm_ctx_tc, - cd->content, cd->content_len, - 0, 0, - cd->id, s->num, flags); - } - } else { - if (mpm_ctx_ts != NULL) { - MpmAddPatternCS(mpm_ctx_ts, - cd->content, cd->content_len, - 0, 0, - cd->id, s->num, flags); - } - if (mpm_ctx_tc != NULL) { - MpmAddPatternCS(mpm_ctx_tc, - cd->content, cd->content_len, - 0, 0, - cd->id, s->num, flags); - } - } - } - /* tell matcher we are inspecting uri */ - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - - break; - } - } /* switch (mpm_sm->type) */ - - SCLogDebug("%"PRIu32" adding cd->id %"PRIu32" to the mpm phase " - "(s->num %"PRIu32")", s->id, - ((DetectContentData *)mpm_sm->ctx)->id, s->num); - - return; -} - SigMatch *RetrieveFPForSig(Signature *s) { if (s->mpm_sm != NULL) @@ -1528,37 +1349,6 @@ SigMatch *RetrieveFPForSig(Signature *s) return mpm_sm; } -/** - * \internal - * \brief Setup the mpm content. - * - * \param de_ctx Pointer to the detect engine context. - * \param sgh Pointer to the signature group head against which we are - * adding patterns to the mpm ctx. - * - * \retval 0 Always. - */ -static int PatternMatchPreparePopulateMpm(const DetectEngineCtx *de_ctx, - SigGroupHead *sgh) -{ - uint32_t sig = 0; - for (sig = 0; sig < sgh->sig_cnt; sig++) { - Signature *s = sgh->match_array[sig]; - if (s == NULL) - continue; - if (s->mpm_sm == NULL) - continue; - int list = SigMatchListSMBelongsTo(s, s->mpm_sm); - if (list < 0) - continue; - if (list == DETECT_SM_LIST_PMATCH) - continue; - PopulateMpmAddPatternToMpm(de_ctx, sgh, s, s->mpm_sm); - } /* for (sig = 0; sig < sgh->sig_cnt; sig++) */ - - return 0; -} - /** \internal * \brief The hash function for MpmStore * @@ -1606,6 +1396,9 @@ static char MpmStoreCompareFunc(void *data1, uint16_t len1, void *data2, if (ms1->direction != ms2->direction) return 0; + if (ms1->sm_list != ms2->sm_list) + return 0; + if (SCMemcmp(ms1->sid_array, ms2->sid_array, ms1->sid_array_size) != 0) { @@ -1674,6 +1467,7 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx) HashListTableBucket *htb = NULL; uint32_t stats[MPMB_MAX] = {0}; + uint32_t appstats[APP_MPMS_MAX] = {0}; for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table); htb != NULL; @@ -1683,13 +1477,38 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx) if (ms == NULL) { continue; } - stats[ms->buffer]++; + if (ms->buffer < MPMB_MAX) + stats[ms->buffer]++; + else if (ms->sm_list != DETECT_SM_LIST_PMATCH) { + int i; + for (i = 0; i < APP_MPMS_MAX; i++) { + AppLayerMpms *am = &app_mpms[i]; + if (ms->sm_list == am->sm_list && + ms->direction == am->direction) + { + SCLogDebug("%s %s: %u patterns. Min %u, Max %u. Ctx %p", am->name, + am->direction == SIG_FLAG_TOSERVER ? "toserver":"toclient", + ms->mpm_ctx->pattern_cnt, + ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen, + ms->mpm_ctx); + appstats[i]++; + break; + } + } + } } uint32_t x; for (x = 0; x < MPMB_MAX; x++) { SCLogInfo("Builtin MPM \"%s\": %u", builtin_mpms[x], stats[x]); } + for (x = 0; x < APP_MPMS_MAX; x++) { + if (appstats[x] == 0) + continue; + const char *name = app_mpms[x].name; + char *direction = app_mpms[x].direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient"; + SCLogInfo("AppLayer MPM \"%s %s\": %u", direction, name, appstats[x]); + } } /** @@ -1713,48 +1532,41 @@ void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms) Signature *s = NULL; // TODO const uint32_t sig; - int32_t sgh_mpm_context = 0; - switch (ms->buffer) { - case MPMB_TCP_PKT_TS: - case MPMB_TCP_PKT_TC: - sgh_mpm_context = de_ctx->sgh_mpm_context_proto_tcp_packet; - break; - case MPMB_TCP_STREAM_TS: - case MPMB_TCP_STREAM_TC: - sgh_mpm_context = de_ctx->sgh_mpm_context_stream; - break; - case MPMB_UDP_TS: - case MPMB_UDP_TC: - sgh_mpm_context = de_ctx->sgh_mpm_context_proto_udp_packet; - break; - case MPMB_OTHERIP: - sgh_mpm_context = de_ctx->sgh_mpm_context_proto_other_packet; - break; - default: - break; - } - int dir = 0; - switch (ms->buffer) { - /* TS is 1 */ - case MPMB_TCP_PKT_TS: - case MPMB_TCP_STREAM_TS: - case MPMB_UDP_TS: - dir = 1; - break; - /* TC is 0 */ - default: - case MPMB_UDP_TC: - case MPMB_TCP_STREAM_TC: - case MPMB_TCP_PKT_TC: - case MPMB_OTHERIP: /**< use 0 for other */ + if (ms->buffer != MPMB_MAX) { + BUG_ON(ms->sm_list != DETECT_SM_LIST_PMATCH); + + switch (ms->buffer) { + /* TS is 1 */ + case MPMB_TCP_PKT_TS: + case MPMB_TCP_STREAM_TS: + case MPMB_UDP_TS: + dir = 1; + break; + + /* TC is 0 */ + default: + case MPMB_UDP_TC: + case MPMB_TCP_STREAM_TC: + case MPMB_TCP_PKT_TC: + case MPMB_OTHERIP: /**< use 0 for other */ + dir = 0; + break; + } + } else { + BUG_ON(ms->sm_list == DETECT_SM_LIST_PMATCH); + BUG_ON(ms->direction == 0); + BUG_ON(ms->direction == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)); + + if (ms->direction == SIG_FLAG_TOSERVER) + dir = 1; + else dir = 0; - break; } if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - ms->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, sgh_mpm_context, dir); + ms->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, ms->sgh_mpm_context, dir); } else { ms->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, dir); } @@ -1771,7 +1583,9 @@ void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms) int list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (list < 0) continue; - if (list != DETECT_SM_LIST_PMATCH) + if (list != ms->sm_list) + continue; + if ((s->flags & ms->direction) == 0) continue; SCLogDebug("adding %u", s->id); @@ -1797,25 +1611,34 @@ void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms) PopulateMpmHelperAddPatternToPktCtx(ms->mpm_ctx, cd, s, 0, (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP)); - /* tell matcher we are inspecting packet */ -/* TODO remove! */ - if (!(ms->buffer == MPMB_TCP_STREAM_TC || ms->buffer == MPMB_TCP_STREAM_TS)) { - s->flags |= SIG_FLAG_MPM_PACKET; - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_PACKET_NEG; + if (ms->buffer != MPMB_MAX) { + /* tell matcher we are inspecting packet */ + /* TODO remove! */ + if (!(ms->buffer == MPMB_TCP_STREAM_TC || ms->buffer == MPMB_TCP_STREAM_TS)) { + s->flags |= SIG_FLAG_MPM_PACKET; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_PACKET_NEG; + } + } else { + /* tell matcher we are inspecting stream */ + s->flags |= SIG_FLAG_MPM_STREAM; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_STREAM_NEG; + } } } else { - /* tell matcher we are inspecting stream */ - s->flags |= SIG_FLAG_MPM_STREAM; + /* tell matcher we are inspecting app-layer */ s->mpm_pattern_id_div_8 = cd->id / 8; s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_STREAM_NEG; - } + s->flags |= SIG_FLAG_MPM_APPLAYER; + if (cd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_APPLAYER_NEG; } } } @@ -1848,6 +1671,27 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1; uint8_t sids_array[max_sid]; memset(sids_array, 0x00, max_sid); + int sgh_mpm_context = 0; + + switch (buf) { + case MPMB_TCP_PKT_TS: + case MPMB_TCP_PKT_TC: + sgh_mpm_context = de_ctx->sgh_mpm_context_proto_tcp_packet; + break; + case MPMB_TCP_STREAM_TS: + case MPMB_TCP_STREAM_TC: + sgh_mpm_context = de_ctx->sgh_mpm_context_stream; + break; + case MPMB_UDP_TS: + case MPMB_UDP_TC: + sgh_mpm_context = de_ctx->sgh_mpm_context_proto_udp_packet; + break; + case MPMB_OTHERIP: + sgh_mpm_context = de_ctx->sgh_mpm_context_proto_other_packet; + break; + default: + break; + } switch(buf) { case MPMB_TCP_PKT_TS: @@ -1920,7 +1764,7 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, if (cnt == 0) return NULL; - MpmStore lookup = { sids_array, max_sid, direction, buf, NULL}; + MpmStore lookup = { sids_array, max_sid, direction, buf, DETECT_SM_LIST_PMATCH, 0, NULL}; MpmStore *result = MpmStoreLookup(de_ctx, &lookup); if (result == NULL) { @@ -1938,6 +1782,8 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, copy->sid_array_size = max_sid; copy->buffer = buf; copy->direction = direction; + copy->sm_list = DETECT_SM_LIST_PMATCH; + copy->sgh_mpm_context = sgh_mpm_context; MpmStoreSetup(de_ctx, copy); MpmStoreAdd(de_ctx, copy); @@ -1947,706 +1793,192 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, } } -/** \brief Prepare the pattern matcher ctx in a sig group head. - * - * \todo determine if a content match can set the 'single' flag - * \todo do error checking - * \todo rewrite the COPY stuff - */ -int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) +MpmStore *MpmStorePrepareBuffer2(DetectEngineCtx *de_ctx, SigGroupHead *sgh, AppLayerMpms *am) { - MpmStore *mpm_store = NULL; - if (SGH_PROTO(sh, IPPROTO_TCP)) { - if (SGH_DIRECTION_TS(sh)) { - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TS); - if (mpm_store != NULL) { - sh->mpm_proto_tcp_ctx_ts = mpm_store->mpm_ctx; - if (sh->mpm_proto_tcp_ctx_ts) - sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } + const Signature *s = NULL; + uint32_t sig; + uint32_t cnt = 0; + uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1; + uint8_t sids_array[max_sid]; + memset(sids_array, 0x00, max_sid); - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TS); - if (mpm_store != NULL) { - BUG_ON(mpm_store == NULL); - sh->mpm_stream_ctx_ts = mpm_store->mpm_ctx; - if (sh->mpm_stream_ctx_ts) - sh->flags |= SIG_GROUP_HEAD_MPM_STREAM; - } - } - if (SGH_DIRECTION_TC(sh)) { - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TC); - if (mpm_store != NULL) { - sh->mpm_proto_tcp_ctx_tc = mpm_store->mpm_ctx; - if (sh->mpm_proto_tcp_ctx_tc) - sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } + SCLogDebug("handling %s direction %s for list %d", am->name, + am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient", am->sm_list); - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TC); - if (mpm_store != NULL) { - sh->mpm_stream_ctx_tc = mpm_store->mpm_ctx; - if (sh->mpm_stream_ctx_tc) - sh->flags |= SIG_GROUP_HEAD_MPM_STREAM; - } - } - } else if (SGH_PROTO(sh, IPPROTO_UDP)) { - if (SGH_DIRECTION_TS(sh)) { - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TS); - if (mpm_store != NULL) { - BUG_ON(mpm_store == NULL); - sh->mpm_proto_udp_ctx_ts = mpm_store->mpm_ctx; - - if (sh->mpm_proto_udp_ctx_ts != NULL) - sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } - } - if (SGH_DIRECTION_TC(sh)) { - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TC); - if (mpm_store != NULL) { - sh->mpm_proto_udp_ctx_tc = mpm_store->mpm_ctx; - - if (sh->mpm_proto_udp_ctx_tc != NULL) - sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } - } - } else { - mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_OTHERIP); - if (mpm_store != NULL) { - sh->mpm_proto_other_ctx = mpm_store->mpm_ctx; - - if (sh->mpm_proto_other_ctx != NULL) - sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } - } - - - - Signature *s = NULL; - uint32_t has_co_uri = 0; /**< our sgh has uri inspecting content */ - /* used to indicate if sgh has atleast one sig with http_client_body */ - uint32_t has_co_hcbd = 0; - /* used to indicate if sgh has atleast one sig with http_server_body */ - uint32_t has_co_hsbd = 0; - /* used to indicate if sgh has smtp file_data inspecting content */ - uint32_t has_co_smtp = 0; - /* used to indicate if sgh has atleast one sig with http_header */ - uint32_t has_co_hhd = 0; - /* used to indicate if sgh has atleast one sig with http_raw_header */ - uint32_t has_co_hrhd = 0; - /* used to indicate if sgh has atleast one sig with http_method */ - uint32_t has_co_hmd = 0; - /* used to indicate if sgh has atleast one sig with http_cookie */ - uint32_t has_co_hcd = 0; - /* used to indicate if sgh has atleast one sig with http_raw_uri */ - uint32_t has_co_hrud = 0; - /* used to indicate if sgh has atleast one sig with http_stat_msg */ - uint32_t has_co_hsmd = 0; - /* used to indicate if sgh has atleast one sig with http_stat_code */ - uint32_t has_co_hscd = 0; - /* used to indicate if sgh has atleast one sig with http_user_agent */ - uint32_t has_co_huad = 0; - /* used to indicate if sgh has atleast one sig with http_host */ - uint32_t has_co_hhhd = 0; - /* used to indicate if sgh has atleast one sig with http_raw_host */ - uint32_t has_co_hrhhd = 0; - //uint32_t cnt = 0; - uint32_t sig = 0; - /* sgh has at least one sig with dns_query */ - int has_co_dnsquery = 0; - - /* see if this head has content and/or uricontent */ - for (sig = 0; sig < sh->sig_cnt; sig++) { - s = sh->match_array[sig]; + for (sig = 0; sig < sgh->sig_cnt; sig++) { + s = sgh->match_array[sig]; if (s == NULL) continue; + if (s->mpm_sm == NULL) continue; int list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (list < 0) continue; - if (list == DETECT_SM_LIST_PMATCH) - continue; - - - if (SGH_PROTO(sh, IPPROTO_TCP)) { - switch (list) { - case DETECT_SM_LIST_UMATCH: - has_co_uri = 1; - break; - - case DETECT_SM_LIST_HCBDMATCH: - has_co_hcbd = 1; - break; - - case DETECT_SM_LIST_FILEDATA: - if (s->alproto == ALPROTO_SMTP) - has_co_smtp = 1; - else if (s->alproto == ALPROTO_HTTP) - has_co_hsbd = 1; - else if (s->alproto == ALPROTO_UNKNOWN) { - has_co_smtp = 1; - has_co_hsbd = 1; - } - break; - - case DETECT_SM_LIST_HHDMATCH: - has_co_hhd = 1; - break; - - case DETECT_SM_LIST_HRHDMATCH: - has_co_hrhd = 1; - break; - - case DETECT_SM_LIST_HMDMATCH: - has_co_hmd = 1; - break; - case DETECT_SM_LIST_HCDMATCH: - has_co_hcd = 1; - break; - - case DETECT_SM_LIST_HRUDMATCH: - has_co_hrud = 1; - break; - - case DETECT_SM_LIST_HSMDMATCH: - has_co_hsmd = 1; - break; - - case DETECT_SM_LIST_HSCDMATCH: - has_co_hscd = 1; - break; - - case DETECT_SM_LIST_HUADMATCH: - has_co_huad = 1; - break; - - case DETECT_SM_LIST_HHHDMATCH: - has_co_hhhd = 1; - break; - - case DETECT_SM_LIST_HRHHDMATCH: - has_co_hrhhd = 1; - break; - - case DETECT_SM_LIST_DNSQUERYNAME_MATCH: - has_co_dnsquery = 1; - break; - - default: - BUG_ON(1); - } - - /* UDP */ - } else if (SGH_PROTO(sh, IPPROTO_UDP)) { - switch (list) { - case DETECT_SM_LIST_DNSQUERYNAME_MATCH: - has_co_dnsquery = 1; - break; - - default: - BUG_ON(1); - } - - /* all other protos just support PMATCH */ - } else { - switch (list) { - default: - BUG_ON(1); - } - } - } - - /* intialize contexes */ - if (has_co_uri) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_uri_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 0); - } else { - sh->mpm_uri_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_uri_ctx_ts == NULL) { - SCLogDebug("sh->mpm_uri_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_uri_ctx_ts, de_ctx->mpm_matcher); - } - - if (has_co_hcbd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hcbd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 0); - } else { - sh->mpm_hcbd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_hcbd_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hcbd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hcbd_ctx_ts, de_ctx->mpm_matcher); - } - - if (has_co_hsbd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hsbd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsbd, 1); - } else { - sh->mpm_hsbd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hsbd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hsbd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hsbd_ctx_tc, de_ctx->mpm_matcher); - } - - if (has_co_smtp) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_smtp_filedata_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_smtp, 0); - } else { - sh->mpm_smtp_filedata_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_smtp_filedata_ctx_ts == NULL) { - SCLogDebug("sh->mpm_smtp_filedata_ctx_ts == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_smtp_filedata_ctx_ts, de_ctx->mpm_matcher); - } - - if (has_co_hhd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 0); - sh->mpm_hhd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 1); - } else { - sh->mpm_hhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - sh->mpm_hhd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hhd_ctx_ts == NULL || sh->mpm_hhd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hhd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hhd_ctx_ts, de_ctx->mpm_matcher); - MpmInitCtx(sh->mpm_hhd_ctx_tc, de_ctx->mpm_matcher); - } - - if (has_co_hrhd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hrhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 0); - sh->mpm_hrhd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 1); - } else { - sh->mpm_hrhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - sh->mpm_hrhd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hrhd_ctx_ts == NULL || sh->mpm_hrhd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hrhd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hrhd_ctx_ts, de_ctx->mpm_matcher); - MpmInitCtx(sh->mpm_hrhd_ctx_tc, de_ctx->mpm_matcher); - } - - if (has_co_hmd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 0); - } else { - sh->mpm_hmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_hmd_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hmd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hmd_ctx_ts, de_ctx->mpm_matcher); - } + if ((s->flags & am->direction) == 0) + continue; - if (has_co_hcd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hcd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 0); - sh->mpm_hcd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 1); - } else { - sh->mpm_hcd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - sh->mpm_hcd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hcd_ctx_ts == NULL || sh->mpm_hcd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hcd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } + if (list != am->sm_list) + continue; - MpmInitCtx(sh->mpm_hcd_ctx_ts, de_ctx->mpm_matcher); - MpmInitCtx(sh->mpm_hcd_ctx_tc, de_ctx->mpm_matcher); + sids_array[s->num / 8] |= 1 << (s->num % 8); + cnt++; } - if (has_co_hrud) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hrud_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 0); - } else { - sh->mpm_hrud_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_hrud_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hrud_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } + if (cnt == 0) + return NULL; - MpmInitCtx(sh->mpm_hrud_ctx_ts, de_ctx->mpm_matcher); - } + MpmStore lookup = { sids_array, max_sid, am->direction, MPMB_MAX, am->sm_list, 0, NULL}; - if (has_co_hsmd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 1); - } else { - sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hsmd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hsmd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } - - MpmInitCtx(sh->mpm_hsmd_ctx_tc, de_ctx->mpm_matcher); - } + MpmStore *result = MpmStoreLookup(de_ctx, &lookup); + if (result == NULL) { + SCLogDebug("new unique mpm for %s %s: %u patterns", + am->name, am->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient", cnt); - if (has_co_hscd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 1); - } else { - sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); - } - if (sh->mpm_hscd_ctx_tc == NULL) { - SCLogDebug("sh->mpm_hscd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); + MpmStore *copy = SCCalloc(1, sizeof(MpmStore)); + if (copy == NULL) + return NULL; + uint8_t *sids = SCCalloc(1, max_sid); + if (sids == NULL) { + SCFree(copy); + return NULL; } - MpmInitCtx(sh->mpm_hscd_ctx_tc, de_ctx->mpm_matcher); - } - - if (has_co_huad) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_huad_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 0); - } else { - sh->mpm_huad_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_huad_ctx_ts == NULL) { - SCLogDebug("sh->mpm_huad_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } + memcpy(sids, sids_array, max_sid); + copy->sid_array = sids; + copy->sid_array_size = max_sid; + copy->buffer = MPMB_MAX; + copy->direction = am->direction; + copy->sm_list = am->sm_list; + copy->sgh_mpm_context = am->sgh_mpm_context; - MpmInitCtx(sh->mpm_huad_ctx_ts, de_ctx->mpm_matcher); + MpmStoreSetup(de_ctx, copy); + MpmStoreAdd(de_ctx, copy); + return copy; + } else { + return result; } + return NULL; +} - if (has_co_hhhd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hhhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhhd, 0); - } else { - sh->mpm_hhhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_hhhd_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hhhd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } +/** \todo fixup old mpm ptrs. We could use the array directly later */ +void MpmStoreFixup(SigGroupHead *sgh) +{ + int i = 0; + sgh->mpm_uri_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hrud_ctx_ts = sgh->app_mpms[i++]; - MpmInitCtx(sh->mpm_hhhd_ctx_ts, de_ctx->mpm_matcher); - } + sgh->mpm_hhd_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hhd_ctx_tc = sgh->app_mpms[i++]; - if (has_co_hrhhd) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hrhhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhhd, 0); - } else { - sh->mpm_hrhhd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_hrhhd_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hrhhd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } + sgh->mpm_huad_ctx_ts = sgh->app_mpms[i++]; - MpmInitCtx(sh->mpm_hrhhd_ctx_ts, de_ctx->mpm_matcher); - } + sgh->mpm_hrhd_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hrhd_ctx_tc = sgh->app_mpms[i++]; - if (has_co_dnsquery) { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_dnsquery_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_dnsquery, 0); - } else { - sh->mpm_dnsquery_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx, MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); - } - if (sh->mpm_dnsquery_ctx_ts == NULL) { - SCLogDebug("sh->mpm_hrhhd_ctx == NULL. This should never happen"); - exit(EXIT_FAILURE); - } + sgh->mpm_hmd_ctx_ts = sgh->app_mpms[i++]; - MpmInitCtx(sh->mpm_dnsquery_ctx_ts, de_ctx->mpm_matcher); - } - - if (has_co_uri || - has_co_hcbd || - has_co_hsbd || - has_co_smtp || - has_co_hhd || - has_co_hrhd || - has_co_hmd || - has_co_hcd || - has_co_hsmd || - has_co_hscd || - has_co_hrud || - has_co_huad || - has_co_hhhd || - has_co_hrhhd || - has_co_dnsquery) - { - /* add the patterns of all the rules to the mpms of this sgh */ - PatternMatchPreparePopulateMpm(de_ctx, sh); + sgh->mpm_smtp_filedata_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hsbd_ctx_tc = sgh->app_mpms[i++]; - if (sh->mpm_uri_ctx_ts != NULL) { - if (sh->mpm_uri_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_uri_ctx_ts); - sh->mpm_uri_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_uri_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_uri_ctx_ts->mpm_type].Prepare(sh->mpm_uri_ctx_ts); - } - } - } + sgh->mpm_hsmd_ctx_tc = sgh->app_mpms[i++]; + sgh->mpm_hscd_ctx_tc = sgh->app_mpms[i++]; - if (sh->mpm_hcbd_ctx_ts != NULL) { - if (sh->mpm_hcbd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcbd_ctx_ts); - sh->mpm_hcbd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hcbd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hcbd_ctx_ts->mpm_type].Prepare(sh->mpm_hcbd_ctx_ts); - } - } - } + sgh->mpm_hcbd_ctx_ts = sgh->app_mpms[i++]; - if (sh->mpm_hsbd_ctx_tc != NULL) { - if (sh->mpm_hsbd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hsbd_ctx_tc); - sh->mpm_hsbd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hsbd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hsbd_ctx_tc->mpm_type].Prepare(sh->mpm_hsbd_ctx_tc); - } - } - } + sgh->mpm_hhhd_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hrhhd_ctx_ts = sgh->app_mpms[i++]; - if (sh->mpm_smtp_filedata_ctx_ts != NULL) { - if (sh->mpm_smtp_filedata_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_smtp_filedata_ctx_ts); - sh->mpm_smtp_filedata_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_smtp_filedata_ctx_ts->mpm_type].Prepare != NULL) { - mpm_table[sh->mpm_smtp_filedata_ctx_ts->mpm_type].Prepare(sh->mpm_smtp_filedata_ctx_ts); - } - } - } - } + sgh->mpm_hcd_ctx_ts = sgh->app_mpms[i++]; + sgh->mpm_hcd_ctx_tc = sgh->app_mpms[i++]; - if (sh->mpm_hhd_ctx_ts != NULL) { - if (sh->mpm_hhd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhd_ctx_ts); - sh->mpm_hhd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hhd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hhd_ctx_ts->mpm_type].Prepare(sh->mpm_hhd_ctx_ts); - } - } - } - if (sh->mpm_hhd_ctx_tc != NULL) { - if (sh->mpm_hhd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhd_ctx_tc); - sh->mpm_hhd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hhd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hhd_ctx_tc->mpm_type].Prepare(sh->mpm_hhd_ctx_tc); - } - } - } + sgh->mpm_dnsquery_ctx_ts = sgh->app_mpms[i++]; - if (sh->mpm_hrhd_ctx_ts != NULL) { - if (sh->mpm_hrhd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhd_ctx_ts); - sh->mpm_hrhd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hrhd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hrhd_ctx_ts->mpm_type].Prepare(sh->mpm_hrhd_ctx_ts); - } - } - } - if (sh->mpm_hrhd_ctx_tc != NULL) { - if (sh->mpm_hrhd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhd_ctx_tc); - sh->mpm_hrhd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hrhd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hrhd_ctx_tc->mpm_type].Prepare(sh->mpm_hrhd_ctx_tc); - } - } - } - - if (sh->mpm_hmd_ctx_ts != NULL) { - if (sh->mpm_hmd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hmd_ctx_ts); - sh->mpm_hmd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hmd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hmd_ctx_ts->mpm_type].Prepare(sh->mpm_hmd_ctx_ts); - } - } - } + BUG_ON(APP_MPMS_MAX != 18 || i != 18); +} - if (sh->mpm_hcd_ctx_ts != NULL) { - if (sh->mpm_hcd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcd_ctx_ts); - sh->mpm_hcd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hcd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hcd_ctx_ts->mpm_type].Prepare(sh->mpm_hcd_ctx_ts); - } - } - } - if (sh->mpm_hcd_ctx_tc != NULL) { - if (sh->mpm_hcd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcd_ctx_tc); - sh->mpm_hcd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hcd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hcd_ctx_tc->mpm_type].Prepare(sh->mpm_hcd_ctx_tc); - } +/** \brief Prepare the pattern matcher ctx in a sig group head. + * + */ +int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) +{ + MpmStore *mpm_store = NULL; + if (SGH_PROTO(sh, IPPROTO_TCP)) { + if (SGH_DIRECTION_TS(sh)) { + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TS); + if (mpm_store != NULL) { + sh->mpm_proto_tcp_ctx_ts = mpm_store->mpm_ctx; + if (sh->mpm_proto_tcp_ctx_ts) + sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; } - } - if (sh->mpm_hrud_ctx_ts != NULL) { - if (sh->mpm_hrud_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrud_ctx_ts); - sh->mpm_hrud_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hrud_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hrud_ctx_ts->mpm_type].Prepare(sh->mpm_hrud_ctx_ts); - } + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TS); + if (mpm_store != NULL) { + BUG_ON(mpm_store == NULL); + sh->mpm_stream_ctx_ts = mpm_store->mpm_ctx; + if (sh->mpm_stream_ctx_ts) + sh->flags |= SIG_GROUP_HEAD_MPM_STREAM; } } - - if (sh->mpm_hsmd_ctx_tc != NULL) { - if (sh->mpm_hsmd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hsmd_ctx_tc); - sh->mpm_hsmd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare(sh->mpm_hsmd_ctx_tc); - } + if (SGH_DIRECTION_TC(sh)) { + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TC); + if (mpm_store != NULL) { + sh->mpm_proto_tcp_ctx_tc = mpm_store->mpm_ctx; + if (sh->mpm_proto_tcp_ctx_tc) + sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; } - } - if (sh->mpm_hscd_ctx_tc != NULL) { - if (sh->mpm_hscd_ctx_tc->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hscd_ctx_tc); - sh->mpm_hscd_ctx_tc = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare(sh->mpm_hscd_ctx_tc); - } + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TC); + if (mpm_store != NULL) { + sh->mpm_stream_ctx_tc = mpm_store->mpm_ctx; + if (sh->mpm_stream_ctx_tc) + sh->flags |= SIG_GROUP_HEAD_MPM_STREAM; } - } + } + } else if (SGH_PROTO(sh, IPPROTO_UDP)) { + if (SGH_DIRECTION_TS(sh)) { + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TS); + if (mpm_store != NULL) { + BUG_ON(mpm_store == NULL); + sh->mpm_proto_udp_ctx_ts = mpm_store->mpm_ctx; - if (sh->mpm_huad_ctx_ts != NULL) { - if (sh->mpm_huad_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_huad_ctx_ts); - sh->mpm_huad_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_huad_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_huad_ctx_ts->mpm_type].Prepare(sh->mpm_huad_ctx_ts); - } + if (sh->mpm_proto_udp_ctx_ts != NULL) + sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; } } + if (SGH_DIRECTION_TC(sh)) { + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TC); + if (mpm_store != NULL) { + sh->mpm_proto_udp_ctx_tc = mpm_store->mpm_ctx; - if (sh->mpm_hhhd_ctx_ts != NULL) { - if (sh->mpm_hhhd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhhd_ctx_ts); - sh->mpm_hhhd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hhhd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hhhd_ctx_ts->mpm_type].Prepare(sh->mpm_hhhd_ctx_ts); - } + if (sh->mpm_proto_udp_ctx_tc != NULL) + sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; } } + } else { + mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_OTHERIP); + if (mpm_store != NULL) { + sh->mpm_proto_other_ctx = mpm_store->mpm_ctx; - if (sh->mpm_hrhhd_ctx_ts != NULL) { - if (sh->mpm_hrhhd_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhhd_ctx_ts); - sh->mpm_hrhhd_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_hrhhd_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hrhhd_ctx_ts->mpm_type].Prepare(sh->mpm_hrhhd_ctx_ts); - } - } + if (sh->mpm_proto_other_ctx != NULL) + sh->flags |= SIG_GROUP_HEAD_MPM_PACKET; } + } - if (sh->mpm_dnsquery_ctx_ts != NULL) { - if (sh->mpm_dnsquery_ctx_ts->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_dnsquery_ctx_ts); - sh->mpm_dnsquery_ctx_ts = NULL; - } else { - if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) { - if (mpm_table[sh->mpm_dnsquery_ctx_ts->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_dnsquery_ctx_ts->mpm_type].Prepare(sh->mpm_dnsquery_ctx_ts); - } - } + AppLayerMpms *a = app_mpms; + while (a->name != NULL) { + mpm_store = MpmStorePrepareBuffer2(de_ctx, sh, a); + if (mpm_store != NULL) { + sh->app_mpms[a->id] = mpm_store->mpm_ctx; + if (sh->app_mpms[a->id] != NULL) + sh->flags |= a->flags; } - } else { - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_uri_ctx_ts); - sh->mpm_uri_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcbd_ctx_ts); - sh->mpm_hcbd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhd_ctx_ts); - sh->mpm_hhd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhd_ctx_ts); - sh->mpm_hrhd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hmd_ctx_ts); - sh->mpm_hmd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcd_ctx_ts); - sh->mpm_hcd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrud_ctx_ts); - sh->mpm_hrud_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_huad_ctx_ts); - sh->mpm_huad_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhhd_ctx_ts); - sh->mpm_hhhd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhhd_ctx_ts); - sh->mpm_hrhhd_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_dnsquery_ctx_ts); - sh->mpm_dnsquery_ctx_ts = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_smtp_filedata_ctx_ts); - sh->mpm_smtp_filedata_ctx_ts = NULL; - - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hhd_ctx_tc); - sh->mpm_hhd_ctx_tc = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hrhd_ctx_tc); - sh->mpm_hrhd_ctx_tc = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hcd_ctx_tc); - sh->mpm_hcd_ctx_tc = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hsmd_ctx_tc); - sh->mpm_hsmd_ctx_tc = NULL; - MpmFactoryReClaimMpmCtx(de_ctx, sh->mpm_hscd_ctx_tc); - sh->mpm_hscd_ctx_tc = NULL; + a++; } + MpmStoreFixup(sh); return 0; } diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h index 235b96da08..4cbc0fbe80 100644 --- a/src/detect-engine-mpm.h +++ b/src/detect-engine-mpm.h @@ -32,6 +32,9 @@ #include "stream.h" +void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx); +void DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx); + uint16_t PatternMatchDefaultMatcher(void); uint32_t PatternStrength(uint8_t *, uint16_t); diff --git a/src/detect.c b/src/detect.c index 1abf9d5459..23df4b30eb 100644 --- a/src/detect.c +++ b/src/detect.c @@ -2732,54 +2732,14 @@ static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx) de_ctx->sgh_mpm_context_proto_other_packet = MpmFactoryRegisterMpmCtxProfile(de_ctx, "packet_proto_other", MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_uri = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "uri", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); de_ctx->sgh_mpm_context_stream = MpmFactoryRegisterMpmCtxProfile(de_ctx, "stream", MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hcbd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hcbd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hsbd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hsbd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_smtp = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "smtp", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hhd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hhd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hrhd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hrhd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hmd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hmd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hcd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hcd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hrud = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hrud", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hsmd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hsmd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hscd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hscd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_huad = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "huad", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hhhd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hhhd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); - de_ctx->sgh_mpm_context_hrhhd = - MpmFactoryRegisterMpmCtxProfile(de_ctx, "hrhhd", - MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD); de_ctx->sgh_mpm_context_app_proto_detect = MpmFactoryRegisterMpmCtxProfile(de_ctx, "app_proto_detect", 0); + DetectMpmInitializeAppMpms(de_ctx); + return; } @@ -3690,7 +3650,6 @@ int SigGroupBuild(DetectEngineCtx *de_ctx) } } #endif - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); @@ -3717,96 +3676,6 @@ int SigGroupBuild(DetectEngineCtx *de_ctx) } //printf("packet- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("uri- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hcbd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsbd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsbd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hsbd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_smtp, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_smtp, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("smtp- %d\n"; mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hhd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hrhd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hmd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hcd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hrud- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); @@ -3817,62 +3686,7 @@ int SigGroupBuild(DetectEngineCtx *de_ctx) } //printf("stream- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hsmd- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hsmd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hscd- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hscd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("huad- %d\n", mpm_ctx->pattern_cnt); - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("huad- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhhd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hhhd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhhd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hhhd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhhd, 0); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hrhhd- %d\n", mpm_ctx->pattern_cnt); - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhhd, 1); - if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { - mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); - } - //printf("hrhhd- %d\n", mpm_ctx->pattern_cnt); + DetectMpmPrepareAppMpms(de_ctx); #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) { diff --git a/src/detect.h b/src/detect.h index e1c441b0da..5ca200f82d 100644 --- a/src/detect.h +++ b/src/detect.h @@ -655,22 +655,7 @@ typedef struct DetectEngineCtx_ { int32_t sgh_mpm_context_proto_udp_packet; int32_t sgh_mpm_context_proto_other_packet; int32_t sgh_mpm_context_stream; - int32_t sgh_mpm_context_uri; - int32_t sgh_mpm_context_hcbd; - int32_t sgh_mpm_context_hsbd; - int32_t sgh_mpm_context_hhd; - int32_t sgh_mpm_context_hrhd; - int32_t sgh_mpm_context_hmd; - int32_t sgh_mpm_context_hcd; - int32_t sgh_mpm_context_hrud; - int32_t sgh_mpm_context_hsmd; - int32_t sgh_mpm_context_hscd; - int32_t sgh_mpm_context_huad; - int32_t sgh_mpm_context_hhhd; - int32_t sgh_mpm_context_hrhhd; int32_t sgh_mpm_context_app_proto_detect; - int32_t sgh_mpm_context_dnsquery; - int32_t sgh_mpm_context_smtp; /* the max local id used amongst all sigs */ int32_t byte_extract_max_local_id; @@ -959,6 +944,8 @@ typedef struct SigTableElmt_ { #define SIG_GROUP_HEAD_MPM_DNSQUERY (1 << 23) #define SIG_GROUP_HEAD_MPM_FD_SMTP (1 << 24) +#define APP_MPMS_MAX 18 + enum MpmBuiltinBuffers { MPMB_TCP_PKT_TS, MPMB_TCP_PKT_TC, @@ -976,6 +963,8 @@ typedef struct MpmStore_ { int direction; enum MpmBuiltinBuffers buffer; + int sm_list; + int32_t sgh_mpm_context; MpmCtx *mpm_ctx; @@ -1055,6 +1044,8 @@ typedef struct SigGroupHead_ { /** Array with sig ptrs... size is sig_cnt * sizeof(Signature *) */ Signature **match_array; + MpmCtx *app_mpms[APP_MPMS_MAX]; + /* ptr to our init data we only use at... init :) */ SigGroupHeadInitData *init; } SigGroupHead; diff --git a/src/util-mpm-ac.c b/src/util-mpm-ac.c index 8cf31fcd9c..341ac5079f 100644 --- a/src/util-mpm-ac.c +++ b/src/util-mpm-ac.c @@ -1550,197 +1550,9 @@ void DetermineCudaStateTableSize(DetectEngineCtx *de_ctx) ac_32_tables++; } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_uri, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcbd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hhd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrhd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hmd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hcd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hrud, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hsmd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_hscd, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 0); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_huad, 1); - if (mpm_ctx->mpm_type == MPM_AC_CUDA) { - SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; - if (ctx->state_count < 32767) - ac_16_tables++; - else - ac_32_tables++; - } - if (ac_16_tables > 0 && ac_32_tables > 0) SCACConstructBoth16and32StateTables(); - SCLogDebug("Total mpm ac 16 bit state tables - %d\n", ac_16_tables); SCLogDebug("Total mpm ac 32 bit state tables - %d\n", ac_32_tables);