aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pattern matcher options support

Browse Source
remotes/origin/master-1.0.x
Gurvinder Singh 17 years ago committed by Victor Julien
parent d0404d8447
commit 999a200bc9
11 changed files with 375 additions and 60 deletions
Show Stats Download Patch File Download Diff File

5
src/app-layer-detect-proto.c
Unescape Escape View File

@ -22,6 +22,7 @@
#include "detect.h"
#include "detect-engine.h"
#include "detect-content.h"
#include "detect-engine-mpm.h"
#include "util-print.h"
#include "util-pool.h"
@ -61,8 +62,8 @@ static AlpProtoDetectCtx alp_proto_ctx;
void AlpProtoInit(AlpProtoDetectCtx *ctx) {
memset(ctx, 0x00, sizeof(AlpProtoDetectCtx));
MpmInitCtx(&ctx->toserver.mpm_ctx, MPM_B2G);
MpmInitCtx(&ctx->toclient.mpm_ctx, MPM_B2G);
MpmInitCtx(&ctx->toserver.mpm_ctx, PatternMatchDefaultMatcher());
MpmInitCtx(&ctx->toclient.mpm_ctx, PatternMatchDefaultMatcher());
memset(&ctx->toserver.map, 0x00, sizeof(ctx->toserver.map));
memset(&ctx->toclient.map, 0x00, sizeof(ctx->toclient.map));

21
src/detect-engine-mpm.c
Unescape Escape View File

@ -9,6 +9,7 @@
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "util-mpm.h"
#include "conf.h"
#include "flow.h"
#include "flow-var.h"
@ -25,8 +26,26 @@
#define PM MPM_B2G
//#define PM MPM_B3G
/** \brief Function to return the default multi pattern matcher algorithm to be
* used by the engine
* \retval mpm algo value
*/
uint16_t PatternMatchDefaultMatcher(void) {
return PM;
char *mpm_algo;
uint16_t mpm_algo_val = PM;
/* Get the mpm algo defined in config file by the user */
if ((ConfGet("mpm-algo", &mpm_algo)) == 1) {
if(strncmp(mpm_algo, "b2g", 3) == 0) {
mpm_algo_val = MPM_B2G;
} else if (strncmp(mpm_algo, "b3g", 3) == 0) {
mpm_algo_val = MPM_B3G;
} else if (strncmp(mpm_algo, "wumanber", 7) == 0) {
mpm_algo_val = MPM_WUMANBER;
}
}
return mpm_algo_val;
}
/** \brief Pattern match, scan part -- searches for only 'scan' patterns,

107
src/util-mpm-b2g.c
Unescape Escape View File

@ -23,6 +23,7 @@
#include "util-debug.h"
#include "util-unittest.h"
#include "conf.h"
#define INIT_HASH_SIZE 65536
@ -33,6 +34,11 @@
#define COUNT(counter)
#endif /* B2G_COUNTERS */
static uint32_t b2g_hash_size = 0;
static uint32_t b2g_bloom_size = 0;
static void *b2g_scan_func;
static void *b2g_search_func;
void B2gInitCtx (MpmCtx *);
void B2gThreadInitCtx(MpmCtx *, MpmThreadCtx *, uint32_t);
void B2gDestroyCtx(MpmCtx *);
@ -566,7 +572,7 @@ static void B2gPrepareScanHash(MpmCtx *mpm_ctx) {
if (hi == NULL)
continue;
ctx->scan_bloom[h] = BloomFilterInit(B2G_BLOOMSIZE, 2, B2gBloomHash);
ctx->scan_bloom[h] = BloomFilterInit(b2g_bloom_size, 2, B2gBloomHash);
if (ctx->scan_bloom[h] == NULL)
continue;
@ -672,7 +678,7 @@ static void B2gPrepareSearchHash(MpmCtx *mpm_ctx) {
if (hi == NULL)
continue;
ctx->search_bloom[h] = BloomFilterInit(B2G_BLOOMSIZE, 2, B2gBloomHash);
ctx->search_bloom[h] = BloomFilterInit(b2g_bloom_size, 2, B2gBloomHash);
if (ctx->search_bloom[h] == NULL)
continue;
@ -694,6 +700,7 @@ error:
}
int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) {
SCEnter();
B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
ctx->scan_B2G = malloc(sizeof(B2G_TYPE) * ctx->scan_hash_size);
@ -703,7 +710,7 @@ int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) {
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += (sizeof(B2G_TYPE) * ctx->scan_hash_size);
memset(ctx->scan_B2G,0, B2G_HASHSIZE * sizeof(B2G_TYPE));
memset(ctx->scan_B2G,0, b2g_hash_size * sizeof(B2G_TYPE));
uint32_t j;
uint32_t a;
@ -725,7 +732,7 @@ int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) {
}
ctx->scan_s0 = 1;
return 0;
SCReturnInt(0);
}
int B2gBuildSearchMatchArray(MpmCtx *mpm_ctx) {
@ -738,7 +745,7 @@ int B2gBuildSearchMatchArray(MpmCtx *mpm_ctx) {
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += (sizeof(B2G_TYPE) * ctx->search_hash_size);
memset(ctx->search_B2G,0, B2G_HASHSIZE * sizeof(B2G_TYPE));
memset(ctx->search_B2G,0, b2g_hash_size * sizeof(B2G_TYPE));
uint32_t j;
uint32_t a;
@ -830,7 +837,7 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
if (mpm_ctx->search_minlen == 1) {
ctx->Search = B2gSearch1;
ctx->MBSearch = B2G_SEARCHFUNC;
ctx->MBSearch = b2g_search_func;
}
/* make sure 'm' stays in bounds
m can be max WORD_SIZE - 1 */
@ -844,8 +851,8 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
}
if (ctx->search_m < 2) ctx->search_m = 2;
ctx->scan_hash_size = B2G_HASHSIZE;
ctx->search_hash_size = B2G_HASHSIZE;
ctx->scan_hash_size = b2g_hash_size;
ctx->search_hash_size = b2g_hash_size;
B2gPrepareScanHash(mpm_ctx);
B2gPrepareSearchHash(mpm_ctx);
B2gBuildScanMatchArray(mpm_ctx);
@ -860,11 +867,11 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) {
ctx->MBScan2 = B2gScan2;
}
#endif
ctx->MBScan = B2G_SCANFUNC;
ctx->MBScan = b2g_scan_func;
#ifdef B2G_SCAN2
} else if (ctx->scan_2_pat_cnt) {
ctx->Scan = B2gScan2;
ctx->MBScan = B2G_SCANFUNC;
ctx->MBScan = b2g_scan_func;
#endif
}
@ -917,7 +924,72 @@ memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
return 0;
}
void B2gInitCtx (MpmCtx *mpm_ctx) {
/**
* \brief Function to get the user defined values for b2g algorithm from the
* config file 'suricata.yaml'
*/
static void B2gGetConfig()
{
ConfNode *b2g_conf;
const char *hash_val = NULL;
const char *bloom_val = NULL;
const char *scan_algo = NULL;
const char *search_algo = NULL;
/* init defaults */
b2g_hash_size = HASHSIZE_LOW;
b2g_bloom_size = BLOOMSIZE_MEDIUM;
b2g_scan_func = B2G_SCANFUNC;
b2g_search_func = B2G_SEARCHFUNC;
ConfNode *pm = ConfGetNode("pattern-matcher");
if (pm != NULL) {
TAILQ_FOREACH(b2g_conf, &pm->head, next) {
if (strncmp(b2g_conf->val, "b2g", 3) == 0) {
scan_algo = ConfNodeLookupChildValue
(b2g_conf->head.tqh_first, "scan_algo");
search_algo = ConfNodeLookupChildValue
(b2g_conf->head.tqh_first, "search_algo");
hash_val = ConfNodeLookupChildValue
(b2g_conf->head.tqh_first, "hash_size");
bloom_val = ConfNodeLookupChildValue
(b2g_conf->head.tqh_first, "bf_size");
if (scan_algo != NULL) {
if (strcmp(scan_algo, "B2gScan") == 0) {
b2g_scan_func = B2gScan;
} else if (strcmp(scan_algo, "B2gScanBNDMq") == 0) {
b2g_scan_func = B2gScanBNDMq;
}
}
if (search_algo != NULL) {
if (strcmp(search_algo, "B2gSearch") == 0) {
b2g_search_func = B2gSearch;
} else if (strcmp(search_algo, "B2gSearchBNDMq") == 0) {
b2g_search_func = B2gSearchBNDMq;
}
}
if (hash_val != NULL)
b2g_hash_size = MpmGetHashSize(hash_val);
if (bloom_val != NULL)
b2g_bloom_size = MpmGetBloomSize(bloom_val);
SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"",
b2g_hash_size, b2g_bloom_size);
}
}
}
}
void B2gInitCtx (MpmCtx *mpm_ctx)
{
SCEnter();
SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx);
BUG_ON(mpm_ctx->ctx != NULL);
@ -939,9 +1011,16 @@ void B2gInitCtx (MpmCtx *mpm_ctx) {
memset(ctx->init_hash, 0, sizeof(B2gPattern *) * INIT_HASH_SIZE);
/* init defaults */
ctx->Scan = B2G_SCANFUNC;
ctx->Search = B2G_SEARCHFUNC;
/* Initialize the defaults value from the config file. The given check make
sure that we query config file only once for config values */
if (b2g_hash_size == 0)
B2gGetConfig();
/* init defaults scan/search functions */
ctx->Scan = b2g_scan_func;
ctx->Search = b2g_search_func;
SCReturn;
}
void B2gDestroyCtx(MpmCtx *mpm_ctx) {

9
src/util-mpm-b2g.h
Unescape Escape View File

@ -7,13 +7,6 @@
#define B2G_NOCASE 0x01
#define B2G_SCAN 0x02
//#define B2G_HASHSIZE 65536
//#define B2G_HASHSIZE 32768
//#define B2G_HASHSIZE 16384
//#define B2G_HASHSIZE 8192
#define B2G_HASHSIZE 4096
//#define B2G_HASHSIZE 2048
//#define B2G_HASHSHIFT 8
//#define B2G_HASHSHIFT 7
//#define B2G_HASHSHIFT 6
@ -30,8 +23,6 @@
//#define B2G_WORD_SIZE 16
//#define B2G_WORD_SIZE 8
#define B2G_BLOOMSIZE 1024
#define B2G_HASH16(a,b) (((a)<<B2G_HASHSHIFT) | (b))
#define B2G_Q 2

107
src/util-mpm-b3g.c
Unescape Escape View File

@ -17,6 +17,8 @@
#include "util-bloomfilter.h"
#include "util-mpm-b3g.h"
#include "util-unittest.h"
#include "conf.h"
#include "util-debug.h"
#define INIT_HASH_SIZE 65536
@ -27,6 +29,11 @@
#define COUNT(counter)
#endif /* B3G_COUNTERS */
static uint32_t b3g_hash_size = 0;
static uint32_t b3g_bloom_size = 0;
static void *b3g_scan_func;
static void *b3g_search_func;
void B3gInitCtx (MpmCtx *);
void B3gThreadInitCtx(MpmCtx *, MpmThreadCtx *, uint32_t);
void B3gDestroyCtx(MpmCtx *);
@ -542,7 +549,7 @@ static void B3gPrepareScanHash(MpmCtx *mpm_ctx) {
if (hi == NULL)
continue;
ctx->scan_bloom[h] = BloomFilterInit(B3G_BLOOMSIZE, 2, B3gBloomHash);
ctx->scan_bloom[h] = BloomFilterInit(b3g_bloom_size, 2, B3gBloomHash);
if (ctx->scan_bloom[h] == NULL)
continue;
@ -676,7 +683,7 @@ static void B3gPrepareSearchHash(MpmCtx *mpm_ctx) {
if (hi == NULL)
continue;
ctx->search_bloom[h] = BloomFilterInit(B3G_BLOOMSIZE, 2, B3gBloomHash);
ctx->search_bloom[h] = BloomFilterInit(b3g_bloom_size, 2, B3gBloomHash);
if (ctx->search_bloom[h] == NULL)
continue;
@ -708,7 +715,7 @@ int B3gBuildScanMatchArray(MpmCtx *mpm_ctx) {
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += (sizeof(B3G_TYPE) * ctx->scan_hash_size);
memset(ctx->scan_B3G,0, B3G_HASHSIZE * sizeof(B3G_TYPE));
memset(ctx->scan_B3G,0, b3g_hash_size * sizeof(B3G_TYPE));
uint32_t j;
uint32_t a;
@ -742,7 +749,7 @@ int B3gBuildSearchMatchArray(MpmCtx *mpm_ctx) {
mpm_ctx->memory_cnt++;
mpm_ctx->memory_size += (sizeof(B3G_TYPE) * ctx->search_hash_size);
memset(ctx->search_B3G,0, B3G_HASHSIZE * sizeof(B3G_TYPE));
memset(ctx->search_B3G,0, b3g_hash_size * sizeof(B3G_TYPE));
uint32_t j;
uint32_t a;
@ -844,8 +851,8 @@ int B3gPreparePatterns(MpmCtx *mpm_ctx) {
}
if (ctx->search_m < 3) ctx->search_m = 3;
ctx->scan_hash_size = B3G_HASHSIZE;
ctx->search_hash_size = B3G_HASHSIZE;
ctx->scan_hash_size = b3g_hash_size;
ctx->search_hash_size = b3g_hash_size;
B3gPrepareScanHash(mpm_ctx);
B3gPrepareSearchHash(mpm_ctx);
B3gBuildScanMatchArray(mpm_ctx);
@ -855,24 +862,24 @@ int B3gPreparePatterns(MpmCtx *mpm_ctx) {
ctx->Scan = B3gScan1;
if (ctx->scan_2_pat_cnt) {
ctx->Scan = B3gScan12;
ctx->MBScan = B3G_SCANFUNC;
ctx->MBScan = b3g_scan_func;
}
ctx->MBScan = B3G_SCANFUNC;
ctx->MBScan = b3g_scan_func;
} else if (ctx->scan_2_pat_cnt) {
ctx->Scan = B3gScan2;
ctx->MBScan = B3G_SCANFUNC;
ctx->MBScan = b3g_scan_func;
}
if (ctx->search_1_pat_cnt) {
ctx->Search = B3gSearch1;
if (ctx->search_2_pat_cnt) {
ctx->Search = B3gSearch12;
ctx->MBSearch = B3G_SEARCHFUNC;
ctx->MBSearch = b3g_search_func;
}
ctx->MBSearch = B3G_SEARCHFUNC;
ctx->MBSearch = b3g_search_func;
} else if (ctx->search_2_pat_cnt) {
ctx->Search = B3gSearch2;
ctx->MBSearch = B3G_SEARCHFUNC;
ctx->MBSearch = b3g_search_func;
}
return 0;
@ -924,8 +931,71 @@ memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
return 0;
}
void B3gInitCtx (MpmCtx *mpm_ctx) {
//printf("B3gInitCtx: mpm_ctx %p\n", mpm_ctx);
/**
* \brief Function to get the user defined values for b3g algorithm from the
* config file 'suricata.yaml'
*/
void B3gGetConfig()
{
ConfNode *b3g_conf;
const char *hash_val = NULL;
const char *bloom_val = NULL;
const char *scan_algo = NULL;
const char *search_algo = NULL;
/* init defaults */
b3g_hash_size = HASHSIZE_LOW;
b3g_bloom_size = BLOOMSIZE_MEDIUM;
b3g_scan_func = B3G_SCANFUNC;
b3g_search_func = B3G_SEARCHFUNC;
ConfNode *pm = ConfGetNode("pattern-matcher");
if (pm != NULL) {
TAILQ_FOREACH(b3g_conf, &pm->head, next) {
if (strncmp(b3g_conf->val, "b3g", 3) == 0) {
scan_algo = ConfNodeLookupChildValue(b3g_conf->head.tqh_first,
"scan_algo");
search_algo = ConfNodeLookupChildValue(b3g_conf->head.tqh_first,
"search_algo");
hash_val = ConfNodeLookupChildValue(b3g_conf->head.tqh_first,
"hash_size");
bloom_val = ConfNodeLookupChildValue(b3g_conf->head.tqh_first,
"bf_size");
if (scan_algo != NULL) {
if (strcmp(scan_algo, "B3gScan") == 0) {
b3g_scan_func = B3gScan;
} else if (strcmp(scan_algo, "B3gScanBNDMq") == 0) {
b3g_scan_func = B3gScanBNDMq;
}
}
if (search_algo != NULL) {
if (strcmp(search_algo, "B3gSearch") == 0) {
b3g_search_func = B3gSearch;
} else if (strcmp(search_algo, "B3gSearchBNDMq") == 0) {
b3g_search_func = B3gSearchBNDMq;
}
}
if (hash_val != NULL)
b3g_hash_size = MpmGetHashSize(hash_val);
if (bloom_val != NULL)
b3g_bloom_size = MpmGetBloomSize(bloom_val);
SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"",
b3g_hash_size, b3g_bloom_size);
}
}
}
}
void B3gInitCtx (MpmCtx *mpm_ctx)
{
SCLogDebug("mpm_ctx %p\n", mpm_ctx);
mpm_ctx->ctx = malloc(sizeof(B3gCtx));
if (mpm_ctx->ctx == NULL)
@ -944,9 +1014,14 @@ void B3gInitCtx (MpmCtx *mpm_ctx) {
memset(ctx->init_hash, 0, sizeof(B3gPattern *) * INIT_HASH_SIZE);
/* Initialize the defaults value from the config file. The given check make
sure that we query config file only once for config values */
if (b3g_hash_size == 0)
B3gGetConfig();
/* init default */
ctx->Scan = B3G_SCANFUNC;
ctx->Search = B3G_SEARCHFUNC;
ctx->Scan = b3g_scan_func;
ctx->Search = b3g_search_func;
}
void B3gDestroyCtx(MpmCtx *mpm_ctx) {

8
src/util-mpm-b3g.h
Unescape Escape View File

@ -7,12 +7,6 @@
#define B3G_NOCASE 0x01
#define B3G_SCAN 0x02
//#define B3G_HASHSIZE 65536
//#define B3G_HASHSIZE 32768
//#define B3G_HASHSIZE 16384
//#define B3G_HASHSIZE 8192
#define B3G_HASHSIZE 4096
//#define B3G_HASHSHIFT 8
//#define B3G_HASHSHIFT 7
//#define B3G_HASHSHIFT 6
@ -26,8 +20,6 @@
//#define B3G_WORD_SIZE 8
#define B3G_WORD_SIZE 32
#define B3G_BLOOMSIZE 1024
#define B3G_HASH(a,b,c) (((a)<<B3G_HASHSHIFT) | (b)<<(B3G_HASHSHIFT-3) |(c))
#define B3G_Q 3

55
src/util-mpm-wumanber.c
Unescape Escape View File

@ -19,6 +19,7 @@
#include "suricata.h"
#include "util-mpm.h"
#include "util-mpm-wumanber.h"
#include "conf.h"
#include "util-unittest.h"
#include "util-debug.h"
@ -36,6 +37,9 @@
#define HASH9_SIZE 512
#define HASH9(a,b) (((a)<<1) | (b))
static uint32_t wm_hash_size = 0;
static uint32_t wm_bloom_size = 0;
void WmInitCtx (MpmCtx *mpm_ctx);
void WmThreadInitCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, uint32_t);
void WmDestroyCtx(MpmCtx *mpm_ctx);
@ -604,7 +608,7 @@ static void WmScanPrepareHash(MpmCtx *mpm_ctx) {
if (hi == NULL)
continue;
ctx->scan_bloom[h] = BloomFilterInit(WUMANBER_BLOOMSIZE, 2, WmBloomHash);
ctx->scan_bloom[h] = BloomFilterInit(wm_bloom_size, 2, WmBloomHash);
if (ctx->scan_bloom[h] == NULL)
continue;
@ -2188,8 +2192,47 @@ uint32_t WmSearch1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcher
return cnt;
}
void WmInitCtx (MpmCtx *mpm_ctx) {
//printf("WmInitCtx: mpm_ctx %p\n", mpm_ctx);
/**
* \brief Function to get the user defined values for wumanber algorithm from
* the config file 'suricata.yaml'
*/
void WmGetConfig()
{
ConfNode *wm_conf;
const char *hash_val = NULL;
const char *bloom_val = NULL;
/* init defaults */
wm_hash_size = HASHSIZE_LOW;
wm_bloom_size = BLOOMSIZE_MEDIUM;
ConfNode *pm = ConfGetNode("pattern-matcher");
if (pm != NULL) {
TAILQ_FOREACH(wm_conf, &pm->head, next) {
if (strncmp(wm_conf->val, "wumanber", 8) == 0) {
hash_val = ConfNodeLookupChildValue(wm_conf->head.tqh_first,
"hash_size");
bloom_val = ConfNodeLookupChildValue(wm_conf->head.tqh_first,
"bf_size");
if (hash_val != NULL)
wm_hash_size = MpmGetHashSize(hash_val);
if (bloom_val != NULL)
wm_bloom_size = MpmGetBloomSize(bloom_val);
SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"",
wm_hash_size, wm_bloom_size);
}
}
}
}
void WmInitCtx (MpmCtx *mpm_ctx)
{
SCLogDebug("mpm_ctx %p\n", mpm_ctx);
mpm_ctx->ctx = malloc(sizeof(WmCtx));
if (mpm_ctx->ctx == NULL)
@ -2207,6 +2250,12 @@ void WmInitCtx (MpmCtx *mpm_ctx) {
return;
memset(ctx->init_hash, 0, sizeof(WmPattern *) * INIT_HASH_SIZE);
/* Initialize the defaults value from the config file. The given check make
sure that we query config file only once for config values */
if (wm_hash_size == 0)
WmGetConfig();
}
void WmDestroyCtx(MpmCtx *mpm_ctx) {

2
src/util-mpm-wumanber.h
Unescape Escape View File

@ -9,8 +9,6 @@
#define WUMANBER_NOCASE 0x01
#define WUMANBER_SCAN 0x02
#define WUMANBER_BLOOMSIZE 1024
//#define WUMANBER_COUNTERS
typedef struct WmPattern_ {

53
src/util-mpm.c
Unescape Escape View File

@ -6,6 +6,7 @@
#include "util-mpm-wumanber.h"
#include "util-mpm-b2g.h"
#include "util-mpm-b3g.h"
#include "util-hashlist.h"
/** \brief Setup a pmq
* \param pmq Pattern matcher queue to be initialized
@ -294,6 +295,58 @@ void MpmTableSetup(void) {
MpmB3gRegister();
}
/** \brief Function to return the default hash size for the mpm algorithm,
* which has been defined by the user in the config file
*
* \param conf_val pointer to the string value of hash size
* \retval hash_value returns the hash value as defined by user, otherwise
* default low size value
*/
uint32_t MpmGetHashSize(const char *conf_val)
{
SCEnter();
uint32_t hash_value = HASHSIZE_LOW;
if(strncmp(conf_val, "lowest", 6) == 0) {
hash_value = HASHSIZE_LOWEST;
} else if(strncmp(conf_val, "low", 3) == 0) {
hash_value = HASHSIZE_LOW;
} else if(strncmp(conf_val, "medium", 6) == 0) {
hash_value = HASHSIZE_MEDIUM;
} else if(strncmp(conf_val, "high", 4) == 0) {
hash_value = HASHSIZE_HIGH;
} else if(strncmp(conf_val, "highest", 7) == 0) {
hash_value = HASHSIZE_HIGHEST;
} else if(strncmp(conf_val, "max", 3) == 0) {
hash_value = HASHSIZE_MAX;
}
SCReturnInt(hash_value);
}
/** \brief Function to return the default bloomfilter size for the mpm algorithm,
* which has been defined by the user in the config file
*
* \param conf_val pointer to the string value of bloom filter size
* \retval bloom_value returns the bloom filter value as defined by user,
* otherwise default medium size value
*/
uint32_t MpmGetBloomSize(const char *conf_val)
{
SCEnter();
uint32_t bloom_value = BLOOMSIZE_MEDIUM;
if(strncmp(conf_val, "low", 3) == 0) {
bloom_value = BLOOMSIZE_LOW;
} else if(strncmp(conf_val, "medium", 6) == 0) {
bloom_value = BLOOMSIZE_MEDIUM;
} else if(strncmp(conf_val, "high", 4) == 0) {
bloom_value = BLOOMSIZE_HIGH;
}
SCReturnInt(bloom_value);
}
void MpmRegisterTests(void) {
#ifdef UNITTESTS
uint16_t i;

32
src/util-mpm.h
Unescape Escape View File

@ -3,11 +3,31 @@
#ifndef __UTIL_MPM_H__
#define __UTIL_MPM_H__
#define MPM_ENDMATCH_SINGLE 0x01 /* A single match is sufficient. No depth, offset, etc settings. */
#define MPM_ENDMATCH_OFFSET 0x02 /* has offset setting */
#define MPM_ENDMATCH_DEPTH 0x04 /* has depth setting */
#define MPM_ENDMATCH_NOSEARCH 0x08 /* if this matches, no search is required (for this pattern) */
#define MPM_ENDMATCH_SINGLE 0x01 /**< A single match is sufficient. No
depth, offset, etc settings. */
#define MPM_ENDMATCH_OFFSET 0x02 /**< has offset setting */
#define MPM_ENDMATCH_DEPTH 0x04 /**< has depth setting */
#define MPM_ENDMATCH_NOSEARCH 0x08 /**< if this matches, no search is
required (for this pattern) */
#define HASHSIZE_LOWEST 2048 /**< Lowest hash size for the multi
pattern matcher algorithms */
#define HASHSIZE_LOW 4096 /**< Low hash size for the multi
pattern matcher algorithms */
#define HASHSIZE_MEDIUM 8192 /**< Medium hash size for the multi
pattern matcher algorithms */
#define HASHSIZE_HIGH 16384 /**< High hash size for the multi
pattern matcher algorithms */
#define HASHSIZE_HIGHEST 32768 /**< Highest hash size for the multi
pattern matcher algorithms */
#define HASHSIZE_MAX 65536 /**< Max hash size for the multi
pattern matcher algorithms */
#define BLOOMSIZE_LOW 512 /*<* Low bloomfilter size for the multi
pattern matcher algorithms */
#define BLOOMSIZE_MEDIUM 1024 /**< Medium bloomfilter size for the multi
pattern matcher algorithms */
#define BLOOMSIZE_HIGH 2048 /**< High bloomfilter size for the multi
pattern matcher algorithms */
enum {
MPM_NOTSET = 0,
@ -138,6 +158,8 @@ int32_t MpmMatcherGetMaxPatternLength(uint16_t);
void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher);
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t);
uint32_t MpmGetHashSize(const char *);
uint32_t MpmGetBloomSize(const char *);
#endif /* __UTIL_MPM_H__ */

36
suricata.yaml
Unescape Escape View File

@ -42,6 +42,42 @@ defrag:
prealloc: yes
timeout: 60
# Select the multi pattern algorithm you want to run for scan/search the
# in the engine. The supported algorithms are b2g, b3g and wumanber.
mpm-algo: b2g
# The memory settings for hash size of these algorithms can vary from lowest
# (2048) - low (4096) - medium (8192) - high (16384) - highest (32768) - max
# (65536). The bloomfilter sizes of these algorithms can vary from low (512) -
# medium (1024) - high (2048).
#
# For B2g/B3g algorithms, there is a support for two different scan/search
# algorithms. For B2g the scan algorithms are B2gScan & B2gScanBNDMq, and
# search algorithms are B2gSearch & B2gSearchBNDMq. For B3g scan algorithms
# are B3gScan & B3gScanBNDMq, and search algorithms are B3gSearch &
# B3gSearchBNDMq.
#
# For B2g the different scan/search algorithms and, hash and bloom
# filter size settings. For B3g the different scan/search algorithms and, hash
# and bloom filter size settings. For wumanber the hash and bloom filter size
# settings.
pattern-matcher:
- b2g:
scan_algo: B2gScanBNDMq
search_algo: B2gSearchBNDMq
hash_size: low
bf_size: medium
- b3g:
scan_algo: B3gScanBNDMq
search_algo: B3gSearchBNDMq
hash_size: low
bf_size: medium
- wumanber:
hash_size: low
bf_size: medium
# Flow settings:
# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
# for flow allocation inside the engine. You can change this value to allow

Write Preview
Loading…
Cancel
Save