diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index e7cf361a0f..112649b90b 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -22,6 +22,7 @@ #include "detect.h" #include "detect-engine.h" #include "detect-content.h" +#include "detect-engine-mpm.h" #include "util-print.h" #include "util-pool.h" @@ -61,8 +62,8 @@ static AlpProtoDetectCtx alp_proto_ctx; void AlpProtoInit(AlpProtoDetectCtx *ctx) { memset(ctx, 0x00, sizeof(AlpProtoDetectCtx)); - MpmInitCtx(&ctx->toserver.mpm_ctx, MPM_B2G); - MpmInitCtx(&ctx->toclient.mpm_ctx, MPM_B2G); + MpmInitCtx(&ctx->toserver.mpm_ctx, PatternMatchDefaultMatcher()); + MpmInitCtx(&ctx->toclient.mpm_ctx, PatternMatchDefaultMatcher()); memset(&ctx->toserver.map, 0x00, sizeof(ctx->toserver.map)); memset(&ctx->toclient.map, 0x00, sizeof(ctx->toclient.map)); diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index d76f6381b3..b5b793fdae 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -9,6 +9,7 @@ #include "detect-engine-mpm.h" #include "detect-engine-iponly.h" #include "util-mpm.h" +#include "conf.h" #include "flow.h" #include "flow-var.h" @@ -25,8 +26,26 @@ #define PM MPM_B2G //#define PM MPM_B3G +/** \brief Function to return the default multi pattern matcher algorithm to be + * used by the engine + * \retval mpm algo value + */ uint16_t PatternMatchDefaultMatcher(void) { - return PM; + char *mpm_algo; + uint16_t mpm_algo_val = PM; + + /* Get the mpm algo defined in config file by the user */ + if ((ConfGet("mpm-algo", &mpm_algo)) == 1) { + if(strncmp(mpm_algo, "b2g", 3) == 0) { + mpm_algo_val = MPM_B2G; + } else if (strncmp(mpm_algo, "b3g", 3) == 0) { + mpm_algo_val = MPM_B3G; + } else if (strncmp(mpm_algo, "wumanber", 7) == 0) { + mpm_algo_val = MPM_WUMANBER; + } + } + + return mpm_algo_val; } /** \brief Pattern match, scan part -- searches for only 'scan' patterns, diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c index ecb3cacb48..0bb0af704c 100644 --- a/src/util-mpm-b2g.c +++ b/src/util-mpm-b2g.c @@ -23,6 +23,7 @@ #include "util-debug.h" #include "util-unittest.h" +#include "conf.h" #define INIT_HASH_SIZE 65536 @@ -33,6 +34,11 @@ #define COUNT(counter) #endif /* B2G_COUNTERS */ +static uint32_t b2g_hash_size = 0; +static uint32_t b2g_bloom_size = 0; +static void *b2g_scan_func; +static void *b2g_search_func; + void B2gInitCtx (MpmCtx *); void B2gThreadInitCtx(MpmCtx *, MpmThreadCtx *, uint32_t); void B2gDestroyCtx(MpmCtx *); @@ -566,7 +572,7 @@ static void B2gPrepareScanHash(MpmCtx *mpm_ctx) { if (hi == NULL) continue; - ctx->scan_bloom[h] = BloomFilterInit(B2G_BLOOMSIZE, 2, B2gBloomHash); + ctx->scan_bloom[h] = BloomFilterInit(b2g_bloom_size, 2, B2gBloomHash); if (ctx->scan_bloom[h] == NULL) continue; @@ -672,7 +678,7 @@ static void B2gPrepareSearchHash(MpmCtx *mpm_ctx) { if (hi == NULL) continue; - ctx->search_bloom[h] = BloomFilterInit(B2G_BLOOMSIZE, 2, B2gBloomHash); + ctx->search_bloom[h] = BloomFilterInit(b2g_bloom_size, 2, B2gBloomHash); if (ctx->search_bloom[h] == NULL) continue; @@ -694,6 +700,7 @@ error: } int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) { + SCEnter(); B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx; ctx->scan_B2G = malloc(sizeof(B2G_TYPE) * ctx->scan_hash_size); @@ -703,7 +710,7 @@ int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) { mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (sizeof(B2G_TYPE) * ctx->scan_hash_size); - memset(ctx->scan_B2G,0, B2G_HASHSIZE * sizeof(B2G_TYPE)); + memset(ctx->scan_B2G,0, b2g_hash_size * sizeof(B2G_TYPE)); uint32_t j; uint32_t a; @@ -725,7 +732,7 @@ int B2gBuildScanMatchArray(MpmCtx *mpm_ctx) { } ctx->scan_s0 = 1; - return 0; + SCReturnInt(0); } int B2gBuildSearchMatchArray(MpmCtx *mpm_ctx) { @@ -738,7 +745,7 @@ int B2gBuildSearchMatchArray(MpmCtx *mpm_ctx) { mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (sizeof(B2G_TYPE) * ctx->search_hash_size); - memset(ctx->search_B2G,0, B2G_HASHSIZE * sizeof(B2G_TYPE)); + memset(ctx->search_B2G,0, b2g_hash_size * sizeof(B2G_TYPE)); uint32_t j; uint32_t a; @@ -830,7 +837,7 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) { if (mpm_ctx->search_minlen == 1) { ctx->Search = B2gSearch1; - ctx->MBSearch = B2G_SEARCHFUNC; + ctx->MBSearch = b2g_search_func; } /* make sure 'm' stays in bounds m can be max WORD_SIZE - 1 */ @@ -844,8 +851,8 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) { } if (ctx->search_m < 2) ctx->search_m = 2; - ctx->scan_hash_size = B2G_HASHSIZE; - ctx->search_hash_size = B2G_HASHSIZE; + ctx->scan_hash_size = b2g_hash_size; + ctx->search_hash_size = b2g_hash_size; B2gPrepareScanHash(mpm_ctx); B2gPrepareSearchHash(mpm_ctx); B2gBuildScanMatchArray(mpm_ctx); @@ -860,11 +867,11 @@ int B2gPreparePatterns(MpmCtx *mpm_ctx) { ctx->MBScan2 = B2gScan2; } #endif - ctx->MBScan = B2G_SCANFUNC; + ctx->MBScan = b2g_scan_func; #ifdef B2G_SCAN2 } else if (ctx->scan_2_pat_cnt) { ctx->Scan = B2gScan2; - ctx->MBScan = B2G_SCANFUNC; + ctx->MBScan = b2g_scan_func; #endif } @@ -917,7 +924,72 @@ memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { return 0; } -void B2gInitCtx (MpmCtx *mpm_ctx) { +/** + * \brief Function to get the user defined values for b2g algorithm from the + * config file 'suricata.yaml' + */ +static void B2gGetConfig() +{ + ConfNode *b2g_conf; + const char *hash_val = NULL; + const char *bloom_val = NULL; + const char *scan_algo = NULL; + const char *search_algo = NULL; + + /* init defaults */ + b2g_hash_size = HASHSIZE_LOW; + b2g_bloom_size = BLOOMSIZE_MEDIUM; + b2g_scan_func = B2G_SCANFUNC; + b2g_search_func = B2G_SEARCHFUNC; + + ConfNode *pm = ConfGetNode("pattern-matcher"); + + if (pm != NULL) { + + TAILQ_FOREACH(b2g_conf, &pm->head, next) { + if (strncmp(b2g_conf->val, "b2g", 3) == 0) { + + scan_algo = ConfNodeLookupChildValue + (b2g_conf->head.tqh_first, "scan_algo"); + search_algo = ConfNodeLookupChildValue + (b2g_conf->head.tqh_first, "search_algo"); + hash_val = ConfNodeLookupChildValue + (b2g_conf->head.tqh_first, "hash_size"); + bloom_val = ConfNodeLookupChildValue + (b2g_conf->head.tqh_first, "bf_size"); + + if (scan_algo != NULL) { + if (strcmp(scan_algo, "B2gScan") == 0) { + b2g_scan_func = B2gScan; + } else if (strcmp(scan_algo, "B2gScanBNDMq") == 0) { + b2g_scan_func = B2gScanBNDMq; + } + } + + if (search_algo != NULL) { + if (strcmp(search_algo, "B2gSearch") == 0) { + b2g_search_func = B2gSearch; + } else if (strcmp(search_algo, "B2gSearchBNDMq") == 0) { + b2g_search_func = B2gSearchBNDMq; + } + } + + if (hash_val != NULL) + b2g_hash_size = MpmGetHashSize(hash_val); + + if (bloom_val != NULL) + b2g_bloom_size = MpmGetBloomSize(bloom_val); + + SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"", + b2g_hash_size, b2g_bloom_size); + } + } + } +} + +void B2gInitCtx (MpmCtx *mpm_ctx) +{ + SCEnter(); SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx); BUG_ON(mpm_ctx->ctx != NULL); @@ -939,9 +1011,16 @@ void B2gInitCtx (MpmCtx *mpm_ctx) { memset(ctx->init_hash, 0, sizeof(B2gPattern *) * INIT_HASH_SIZE); - /* init defaults */ - ctx->Scan = B2G_SCANFUNC; - ctx->Search = B2G_SEARCHFUNC; + /* Initialize the defaults value from the config file. The given check make + sure that we query config file only once for config values */ + if (b2g_hash_size == 0) + B2gGetConfig(); + + /* init defaults scan/search functions */ + ctx->Scan = b2g_scan_func; + ctx->Search = b2g_search_func; + + SCReturn; } void B2gDestroyCtx(MpmCtx *mpm_ctx) { diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h index 4fe29c2a29..c1a5520ac4 100644 --- a/src/util-mpm-b2g.h +++ b/src/util-mpm-b2g.h @@ -7,13 +7,6 @@ #define B2G_NOCASE 0x01 #define B2G_SCAN 0x02 -//#define B2G_HASHSIZE 65536 -//#define B2G_HASHSIZE 32768 -//#define B2G_HASHSIZE 16384 -//#define B2G_HASHSIZE 8192 -#define B2G_HASHSIZE 4096 -//#define B2G_HASHSIZE 2048 - //#define B2G_HASHSHIFT 8 //#define B2G_HASHSHIFT 7 //#define B2G_HASHSHIFT 6 @@ -30,8 +23,6 @@ //#define B2G_WORD_SIZE 16 //#define B2G_WORD_SIZE 8 -#define B2G_BLOOMSIZE 1024 - #define B2G_HASH16(a,b) (((a)<scan_bloom[h] = BloomFilterInit(B3G_BLOOMSIZE, 2, B3gBloomHash); + ctx->scan_bloom[h] = BloomFilterInit(b3g_bloom_size, 2, B3gBloomHash); if (ctx->scan_bloom[h] == NULL) continue; @@ -676,7 +683,7 @@ static void B3gPrepareSearchHash(MpmCtx *mpm_ctx) { if (hi == NULL) continue; - ctx->search_bloom[h] = BloomFilterInit(B3G_BLOOMSIZE, 2, B3gBloomHash); + ctx->search_bloom[h] = BloomFilterInit(b3g_bloom_size, 2, B3gBloomHash); if (ctx->search_bloom[h] == NULL) continue; @@ -708,7 +715,7 @@ int B3gBuildScanMatchArray(MpmCtx *mpm_ctx) { mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (sizeof(B3G_TYPE) * ctx->scan_hash_size); - memset(ctx->scan_B3G,0, B3G_HASHSIZE * sizeof(B3G_TYPE)); + memset(ctx->scan_B3G,0, b3g_hash_size * sizeof(B3G_TYPE)); uint32_t j; uint32_t a; @@ -742,7 +749,7 @@ int B3gBuildSearchMatchArray(MpmCtx *mpm_ctx) { mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (sizeof(B3G_TYPE) * ctx->search_hash_size); - memset(ctx->search_B3G,0, B3G_HASHSIZE * sizeof(B3G_TYPE)); + memset(ctx->search_B3G,0, b3g_hash_size * sizeof(B3G_TYPE)); uint32_t j; uint32_t a; @@ -844,8 +851,8 @@ int B3gPreparePatterns(MpmCtx *mpm_ctx) { } if (ctx->search_m < 3) ctx->search_m = 3; - ctx->scan_hash_size = B3G_HASHSIZE; - ctx->search_hash_size = B3G_HASHSIZE; + ctx->scan_hash_size = b3g_hash_size; + ctx->search_hash_size = b3g_hash_size; B3gPrepareScanHash(mpm_ctx); B3gPrepareSearchHash(mpm_ctx); B3gBuildScanMatchArray(mpm_ctx); @@ -855,24 +862,24 @@ int B3gPreparePatterns(MpmCtx *mpm_ctx) { ctx->Scan = B3gScan1; if (ctx->scan_2_pat_cnt) { ctx->Scan = B3gScan12; - ctx->MBScan = B3G_SCANFUNC; + ctx->MBScan = b3g_scan_func; } - ctx->MBScan = B3G_SCANFUNC; + ctx->MBScan = b3g_scan_func; } else if (ctx->scan_2_pat_cnt) { ctx->Scan = B3gScan2; - ctx->MBScan = B3G_SCANFUNC; + ctx->MBScan = b3g_scan_func; } if (ctx->search_1_pat_cnt) { ctx->Search = B3gSearch1; if (ctx->search_2_pat_cnt) { ctx->Search = B3gSearch12; - ctx->MBSearch = B3G_SEARCHFUNC; + ctx->MBSearch = b3g_search_func; } - ctx->MBSearch = B3G_SEARCHFUNC; + ctx->MBSearch = b3g_search_func; } else if (ctx->search_2_pat_cnt) { ctx->Search = B3gSearch2; - ctx->MBSearch = B3G_SEARCHFUNC; + ctx->MBSearch = b3g_search_func; } return 0; @@ -924,8 +931,71 @@ memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) { return 0; } -void B3gInitCtx (MpmCtx *mpm_ctx) { - //printf("B3gInitCtx: mpm_ctx %p\n", mpm_ctx); +/** + * \brief Function to get the user defined values for b3g algorithm from the + * config file 'suricata.yaml' + */ +void B3gGetConfig() +{ + ConfNode *b3g_conf; + const char *hash_val = NULL; + const char *bloom_val = NULL; + const char *scan_algo = NULL; + const char *search_algo = NULL; + + /* init defaults */ + b3g_hash_size = HASHSIZE_LOW; + b3g_bloom_size = BLOOMSIZE_MEDIUM; + b3g_scan_func = B3G_SCANFUNC; + b3g_search_func = B3G_SEARCHFUNC; + + ConfNode *pm = ConfGetNode("pattern-matcher"); + + if (pm != NULL) { + + TAILQ_FOREACH(b3g_conf, &pm->head, next) { + if (strncmp(b3g_conf->val, "b3g", 3) == 0) { + scan_algo = ConfNodeLookupChildValue(b3g_conf->head.tqh_first, + "scan_algo"); + search_algo = ConfNodeLookupChildValue(b3g_conf->head.tqh_first, + "search_algo"); + hash_val = ConfNodeLookupChildValue(b3g_conf->head.tqh_first, + "hash_size"); + bloom_val = ConfNodeLookupChildValue(b3g_conf->head.tqh_first, + "bf_size"); + + if (scan_algo != NULL) { + if (strcmp(scan_algo, "B3gScan") == 0) { + b3g_scan_func = B3gScan; + } else if (strcmp(scan_algo, "B3gScanBNDMq") == 0) { + b3g_scan_func = B3gScanBNDMq; + } + } + + if (search_algo != NULL) { + if (strcmp(search_algo, "B3gSearch") == 0) { + b3g_search_func = B3gSearch; + } else if (strcmp(search_algo, "B3gSearchBNDMq") == 0) { + b3g_search_func = B3gSearchBNDMq; + } + } + + if (hash_val != NULL) + b3g_hash_size = MpmGetHashSize(hash_val); + + if (bloom_val != NULL) + b3g_bloom_size = MpmGetBloomSize(bloom_val); + + SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"", + b3g_hash_size, b3g_bloom_size); + } + } + } +} + +void B3gInitCtx (MpmCtx *mpm_ctx) +{ + SCLogDebug("mpm_ctx %p\n", mpm_ctx); mpm_ctx->ctx = malloc(sizeof(B3gCtx)); if (mpm_ctx->ctx == NULL) @@ -944,9 +1014,14 @@ void B3gInitCtx (MpmCtx *mpm_ctx) { memset(ctx->init_hash, 0, sizeof(B3gPattern *) * INIT_HASH_SIZE); + /* Initialize the defaults value from the config file. The given check make + sure that we query config file only once for config values */ + if (b3g_hash_size == 0) + B3gGetConfig(); + /* init default */ - ctx->Scan = B3G_SCANFUNC; - ctx->Search = B3G_SEARCHFUNC; + ctx->Scan = b3g_scan_func; + ctx->Search = b3g_search_func; } void B3gDestroyCtx(MpmCtx *mpm_ctx) { diff --git a/src/util-mpm-b3g.h b/src/util-mpm-b3g.h index a10e8ce2d9..20eed69d16 100644 --- a/src/util-mpm-b3g.h +++ b/src/util-mpm-b3g.h @@ -7,12 +7,6 @@ #define B3G_NOCASE 0x01 #define B3G_SCAN 0x02 -//#define B3G_HASHSIZE 65536 -//#define B3G_HASHSIZE 32768 -//#define B3G_HASHSIZE 16384 -//#define B3G_HASHSIZE 8192 -#define B3G_HASHSIZE 4096 - //#define B3G_HASHSHIFT 8 //#define B3G_HASHSHIFT 7 //#define B3G_HASHSHIFT 6 @@ -26,8 +20,6 @@ //#define B3G_WORD_SIZE 8 #define B3G_WORD_SIZE 32 -#define B3G_BLOOMSIZE 1024 - #define B3G_HASH(a,b,c) (((a)<scan_bloom[h] = BloomFilterInit(WUMANBER_BLOOMSIZE, 2, WmBloomHash); + ctx->scan_bloom[h] = BloomFilterInit(wm_bloom_size, 2, WmBloomHash); if (ctx->scan_bloom[h] == NULL) continue; @@ -2188,8 +2192,47 @@ uint32_t WmSearch1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcher return cnt; } -void WmInitCtx (MpmCtx *mpm_ctx) { - //printf("WmInitCtx: mpm_ctx %p\n", mpm_ctx); +/** + * \brief Function to get the user defined values for wumanber algorithm from + * the config file 'suricata.yaml' + */ +void WmGetConfig() +{ + ConfNode *wm_conf; + const char *hash_val = NULL; + const char *bloom_val = NULL; + + /* init defaults */ + wm_hash_size = HASHSIZE_LOW; + wm_bloom_size = BLOOMSIZE_MEDIUM; + + ConfNode *pm = ConfGetNode("pattern-matcher"); + + if (pm != NULL) { + + TAILQ_FOREACH(wm_conf, &pm->head, next) { + if (strncmp(wm_conf->val, "wumanber", 8) == 0) { + hash_val = ConfNodeLookupChildValue(wm_conf->head.tqh_first, + "hash_size"); + bloom_val = ConfNodeLookupChildValue(wm_conf->head.tqh_first, + "bf_size"); + + if (hash_val != NULL) + wm_hash_size = MpmGetHashSize(hash_val); + + if (bloom_val != NULL) + wm_bloom_size = MpmGetBloomSize(bloom_val); + + SCLogDebug("hash size is %"PRIu32" and bloom size is %"PRIu32"", + wm_hash_size, wm_bloom_size); + } + } + } +} + +void WmInitCtx (MpmCtx *mpm_ctx) +{ + SCLogDebug("mpm_ctx %p\n", mpm_ctx); mpm_ctx->ctx = malloc(sizeof(WmCtx)); if (mpm_ctx->ctx == NULL) @@ -2207,6 +2250,12 @@ void WmInitCtx (MpmCtx *mpm_ctx) { return; memset(ctx->init_hash, 0, sizeof(WmPattern *) * INIT_HASH_SIZE); + + /* Initialize the defaults value from the config file. The given check make + sure that we query config file only once for config values */ + if (wm_hash_size == 0) + WmGetConfig(); + } void WmDestroyCtx(MpmCtx *mpm_ctx) { diff --git a/src/util-mpm-wumanber.h b/src/util-mpm-wumanber.h index 24d2cbc22b..edbd66ac82 100644 --- a/src/util-mpm-wumanber.h +++ b/src/util-mpm-wumanber.h @@ -9,8 +9,6 @@ #define WUMANBER_NOCASE 0x01 #define WUMANBER_SCAN 0x02 -#define WUMANBER_BLOOMSIZE 1024 - //#define WUMANBER_COUNTERS typedef struct WmPattern_ { diff --git a/src/util-mpm.c b/src/util-mpm.c index e31a20d10a..7a22a718e1 100644 --- a/src/util-mpm.c +++ b/src/util-mpm.c @@ -6,6 +6,7 @@ #include "util-mpm-wumanber.h" #include "util-mpm-b2g.h" #include "util-mpm-b3g.h" +#include "util-hashlist.h" /** \brief Setup a pmq * \param pmq Pattern matcher queue to be initialized @@ -294,6 +295,58 @@ void MpmTableSetup(void) { MpmB3gRegister(); } +/** \brief Function to return the default hash size for the mpm algorithm, + * which has been defined by the user in the config file + * + * \param conf_val pointer to the string value of hash size + * \retval hash_value returns the hash value as defined by user, otherwise + * default low size value + */ +uint32_t MpmGetHashSize(const char *conf_val) +{ + SCEnter(); + uint32_t hash_value = HASHSIZE_LOW; + + if(strncmp(conf_val, "lowest", 6) == 0) { + hash_value = HASHSIZE_LOWEST; + } else if(strncmp(conf_val, "low", 3) == 0) { + hash_value = HASHSIZE_LOW; + } else if(strncmp(conf_val, "medium", 6) == 0) { + hash_value = HASHSIZE_MEDIUM; + } else if(strncmp(conf_val, "high", 4) == 0) { + hash_value = HASHSIZE_HIGH; + } else if(strncmp(conf_val, "highest", 7) == 0) { + hash_value = HASHSIZE_HIGHEST; + } else if(strncmp(conf_val, "max", 3) == 0) { + hash_value = HASHSIZE_MAX; + } + + SCReturnInt(hash_value); +} + +/** \brief Function to return the default bloomfilter size for the mpm algorithm, + * which has been defined by the user in the config file + * + * \param conf_val pointer to the string value of bloom filter size + * \retval bloom_value returns the bloom filter value as defined by user, + * otherwise default medium size value + */ +uint32_t MpmGetBloomSize(const char *conf_val) +{ + SCEnter(); + uint32_t bloom_value = BLOOMSIZE_MEDIUM; + + if(strncmp(conf_val, "low", 3) == 0) { + bloom_value = BLOOMSIZE_LOW; + } else if(strncmp(conf_val, "medium", 6) == 0) { + bloom_value = BLOOMSIZE_MEDIUM; + } else if(strncmp(conf_val, "high", 4) == 0) { + bloom_value = BLOOMSIZE_HIGH; + } + + SCReturnInt(bloom_value); +} + void MpmRegisterTests(void) { #ifdef UNITTESTS uint16_t i; diff --git a/src/util-mpm.h b/src/util-mpm.h index aae547f6a5..3dc1f6815d 100644 --- a/src/util-mpm.h +++ b/src/util-mpm.h @@ -3,11 +3,31 @@ #ifndef __UTIL_MPM_H__ #define __UTIL_MPM_H__ -#define MPM_ENDMATCH_SINGLE 0x01 /* A single match is sufficient. No depth, offset, etc settings. */ -#define MPM_ENDMATCH_OFFSET 0x02 /* has offset setting */ -#define MPM_ENDMATCH_DEPTH 0x04 /* has depth setting */ -#define MPM_ENDMATCH_NOSEARCH 0x08 /* if this matches, no search is required (for this pattern) */ - +#define MPM_ENDMATCH_SINGLE 0x01 /**< A single match is sufficient. No + depth, offset, etc settings. */ +#define MPM_ENDMATCH_OFFSET 0x02 /**< has offset setting */ +#define MPM_ENDMATCH_DEPTH 0x04 /**< has depth setting */ +#define MPM_ENDMATCH_NOSEARCH 0x08 /**< if this matches, no search is + required (for this pattern) */ + +#define HASHSIZE_LOWEST 2048 /**< Lowest hash size for the multi + pattern matcher algorithms */ +#define HASHSIZE_LOW 4096 /**< Low hash size for the multi + pattern matcher algorithms */ +#define HASHSIZE_MEDIUM 8192 /**< Medium hash size for the multi + pattern matcher algorithms */ +#define HASHSIZE_HIGH 16384 /**< High hash size for the multi + pattern matcher algorithms */ +#define HASHSIZE_HIGHEST 32768 /**< Highest hash size for the multi + pattern matcher algorithms */ +#define HASHSIZE_MAX 65536 /**< Max hash size for the multi + pattern matcher algorithms */ +#define BLOOMSIZE_LOW 512 /*<* Low bloomfilter size for the multi + pattern matcher algorithms */ +#define BLOOMSIZE_MEDIUM 1024 /**< Medium bloomfilter size for the multi + pattern matcher algorithms */ +#define BLOOMSIZE_HIGH 2048 /**< High bloomfilter size for the multi + pattern matcher algorithms */ enum { MPM_NOTSET = 0, @@ -138,6 +158,8 @@ int32_t MpmMatcherGetMaxPatternLength(uint16_t); void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher); void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t); +uint32_t MpmGetHashSize(const char *); +uint32_t MpmGetBloomSize(const char *); #endif /* __UTIL_MPM_H__ */ diff --git a/suricata.yaml b/suricata.yaml index 378827de9c..f624163f0e 100644 --- a/suricata.yaml +++ b/suricata.yaml @@ -42,6 +42,42 @@ defrag: prealloc: yes timeout: 60 +# Select the multi pattern algorithm you want to run for scan/search the +# in the engine. The supported algorithms are b2g, b3g and wumanber. + +mpm-algo: b2g + +# The memory settings for hash size of these algorithms can vary from lowest +# (2048) - low (4096) - medium (8192) - high (16384) - highest (32768) - max +# (65536). The bloomfilter sizes of these algorithms can vary from low (512) - +# medium (1024) - high (2048). +# +# For B2g/B3g algorithms, there is a support for two different scan/search +# algorithms. For B2g the scan algorithms are B2gScan & B2gScanBNDMq, and +# search algorithms are B2gSearch & B2gSearchBNDMq. For B3g scan algorithms +# are B3gScan & B3gScanBNDMq, and search algorithms are B3gSearch & +# B3gSearchBNDMq. +# +# For B2g the different scan/search algorithms and, hash and bloom +# filter size settings. For B3g the different scan/search algorithms and, hash +# and bloom filter size settings. For wumanber the hash and bloom filter size +# settings. + +pattern-matcher: + - b2g: + scan_algo: B2gScanBNDMq + search_algo: B2gSearchBNDMq + hash_size: low + bf_size: medium + - b3g: + scan_algo: B3gScanBNDMq + search_algo: B3gSearchBNDMq + hash_size: low + bf_size: medium + - wumanber: + hash_size: low + bf_size: medium + # Flow settings: # By default, the reserved memory (memcap) for flows is 32MB. This is the limit # for flow allocation inside the engine. You can change this value to allow