From a806445abfec7eeb091b6bb0baf26d588019d73b Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 18 Mar 2023 19:56:07 +0100 Subject: [PATCH] mpm factory: include alproto In preparation of spliting out mpm's for keywords shared by multiple protocols, like file.data. --- src/detect-engine-mpm.c | 17 +++++++++++------ src/util-mpm.c | 7 +++++-- src/util-mpm.h | 5 ++++- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index e29ddbe725..c83a3fb6dc 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -167,7 +167,8 @@ void DetectAppLayerMpmRegisterByParentId(DetectEngineCtx *de_ctx, am->app_v2.tx_min_progress = t->app_v2.tx_min_progress; am->priority = t->priority; am->sgh_mpm_context = t->sgh_mpm_context; - am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, am->name, am->sm_list); + am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile( + de_ctx, am->name, am->sm_list, am->app_v2.alproto); am->next = t->next; if (transforms) { memcpy(&am->transforms, transforms, sizeof(*transforms)); @@ -246,7 +247,8 @@ void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx) n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT; } else { SCLogDebug("using shared mpm ctx' for %s", n->name); - n->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list); + n->sgh_mpm_context = + MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list, n->app_v2.alproto); } list = list->next; @@ -415,7 +417,8 @@ void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int if (shared == 0) { am->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT; } else { - am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, am->name, am->sm_list); + am->sgh_mpm_context = + MpmFactoryRegisterMpmCtxProfile(de_ctx, am->name, am->sm_list, alproto); } if (de_ctx->frame_mpms_list == NULL) { @@ -471,7 +474,8 @@ void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx) n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT; } else { SCLogDebug("using shared mpm ctx' for %s", n->name); - n->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list); + n->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile( + de_ctx, n->name, n->sm_list, n->frame_v1.alproto); } list = list->next; @@ -639,7 +643,8 @@ void DetectMpmInitializePktMpms(DetectEngineCtx *de_ctx) n->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT; } else { SCLogDebug("using shared mpm ctx' for %s", n->name); - n->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list); + n->sgh_mpm_context = + MpmFactoryRegisterMpmCtxProfile(de_ctx, n->name, n->sm_list, ALPROTO_UNKNOWN); } list = list->next; @@ -693,7 +698,7 @@ static int32_t SetupBuiltinMpm(DetectEngineCtx *de_ctx, const char *name) ctx = MPM_CTX_FACTORY_UNIQUE_CONTEXT; SCLogDebug("using unique mpm ctx' for %s", name); } else { - ctx = MpmFactoryRegisterMpmCtxProfile(de_ctx, name, DETECT_SM_LIST_PMATCH); + ctx = MpmFactoryRegisterMpmCtxProfile(de_ctx, name, DETECT_SM_LIST_PMATCH, ALPROTO_UNKNOWN); SCLogDebug("using shared mpm ctx' for %s", name); } return ctx; diff --git a/src/util-mpm.c b/src/util-mpm.c index 555286b8e9..1e05097ae5 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -53,11 +53,12 @@ uint8_t mpm_default_matcher; * * \param name A new profile to be registered to store this MpmCtx. * \param sm_list sm_list for this name (might be variable with xforms) + * \param alproto app proto or ALPROTO_UNKNOWN if not for app-layer * * \retval id Return the id created for the new MpmCtx profile. */ int32_t MpmFactoryRegisterMpmCtxProfile( - DetectEngineCtx *de_ctx, const char *name, const int sm_list) + DetectEngineCtx *de_ctx, const char *name, const int sm_list, const AppProto alproto) { /* the very first entry */ if (de_ctx->mpm_ctx_factory_container == NULL) { @@ -71,7 +72,8 @@ int32_t MpmFactoryRegisterMpmCtxProfile( MpmCtxFactoryItem *item = de_ctx->mpm_ctx_factory_container->items; MpmCtxFactoryItem *pitem = NULL; while (item) { - if (item->sm_list == sm_list && item->name != NULL && strcmp(item->name, name) == 0) { + if (item->sm_list == sm_list && item->alproto == alproto && item->name != NULL && + strcmp(item->name, name) == 0) { return item->id; } pitem = item; @@ -85,6 +87,7 @@ int32_t MpmFactoryRegisterMpmCtxProfile( nitem->name = name; nitem->sm_list = sm_list; nitem->id = de_ctx->mpm_ctx_factory_container->max_id++; + nitem->alproto = alproto; /* toserver */ nitem->mpm_ctx_ts = SCCalloc(1, sizeof(MpmCtx)); diff --git a/src/util-mpm.h b/src/util-mpm.h index 1c6b17f3e1..bf3772f951 100644 --- a/src/util-mpm.h +++ b/src/util-mpm.h @@ -24,6 +24,7 @@ #ifndef __UTIL_MPM_H__ #define __UTIL_MPM_H__ +#include "app-layer-protos.h" #include "util-prefilter.h" #define MPM_INIT_HASH_SIZE 65536 @@ -118,6 +119,7 @@ typedef struct MpmCtxFactoryItem { MpmCtx *mpm_ctx_tc; int32_t id; int32_t sm_list; + AppProto alproto; /**< ALPROTO_UNKNOWN is not an app item */ struct MpmCtxFactoryItem *next; } MpmCtxFactoryItem; @@ -174,7 +176,8 @@ extern uint8_t mpm_default_matcher; struct DetectEngineCtx_; -int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *, const int); +int32_t MpmFactoryRegisterMpmCtxProfile( + struct DetectEngineCtx_ *, const char *, const int, const AppProto); void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *); MpmCtx *MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int); void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *); -- 2.47.2