suricata
detect-engine-address.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

void DetectAddressRegister (void)
 
DetectAddressHeadDetectAddressHeadInit (void)
 Returns a new instance of DetectAddressHead. More...
 
void DetectAddressHeadFree (DetectAddressHead *)
 Frees a DetectAddressHead instance. More...
 
void DetectAddressHeadCleanup (DetectAddressHead *)
 Cleans a DetectAddressHead. The functions frees the address group heads(ipv4 and ipv6) inside the DetectAddressHead instance. More...
 
int DetectAddressParseString (DetectAddress *, const char *)
 
int DetectAddressParse (const DetectEngineCtx *, DetectAddressHead *, const char *)
 Parses an address group sent as a character string and updates the DetectAddressHead sent as the argument with the relevant address ranges from the parsed string. More...
 
DetectAddressDetectAddressInit (void)
 Creates and returns a new instance of a DetectAddress. More...
 
void DetectAddressFree (DetectAddress *)
 Frees a DetectAddress instance. More...
 
void DetectAddressCleanupList (DetectAddress *)
 Frees a list of DetectAddress instances. More...
 
int DetectAddressAdd (DetectAddress **, DetectAddress *)
 Do a sorted insert, where the top of the list should be the biggest network/range. More...
 
void DetectAddressPrintList (DetectAddress *)
 Prints the address data information for all the DetectAddress instances in the DetectAddress list sent as the argument. More...
 
int DetectAddressInsert (DetectEngineCtx *, DetectAddressHead *, DetectAddress *)
 Same as DetectAddressInsert, but then for inserting a address group object. This also makes sure SigGroupContainer lists are handled correctly. More...
 
int DetectAddressJoin (DetectEngineCtx *, DetectAddress *, DetectAddress *)
 Join two addresses groups together. More...
 
bool DetectAddressListsAreEqual (DetectAddress *list1, DetectAddress *list2)
 Checks if two address group lists are equal. More...
 
DetectAddressDetectAddressLookupInHead (const DetectAddressHead *, Address *)
 Find the group matching address in a group head. More...
 
DetectAddressDetectAddressLookupInList (DetectAddress *, DetectAddress *)
 Used to check if a DetectAddress list contains an instance with a similar DetectAddress. The comparison done is not the one that checks the memory for the same instance, but one that checks that the two instances hold the same content. More...
 
int DetectAddressMatch (DetectAddress *, Address *)
 Check if a particular address(ipv4 or ipv6) matches the address range in the DetectAddress instance. More...
 
DetectAddressDetectAddressCopy (DetectAddress *)
 Copies the contents of one Address group in DetectAddress and returns a new instance of the DetectAddress that contains the copied address. More...
 
void DetectAddressPrint (DetectAddress *)
 Prints the address data held by the DetectAddress. If the address data family is IPv4, we print the the ipv4 address and mask, and if the address data family is IPv6, we print the ipv6 address and mask. More...
 
int DetectAddressCmp (DetectAddress *, DetectAddress *)
 Used to compare 2 address ranges. More...
 
int DetectAddressMatchIPv4 (const DetectMatchAddressIPv4 *, uint16_t, const Address *)
 Match a packets address against a signatures addrs array. More...
 
int DetectAddressMatchIPv6 (const DetectMatchAddressIPv6 *, uint16_t, const Address *)
 Match a packets address against a signatures addrs array. More...
 
int DetectAddressTestConfVars (void)
 
void DetectAddressTests (void)
 
int DetectAddressMapInit (DetectEngineCtx *de_ctx)
 
void DetectAddressMapFree (DetectEngineCtx *de_ctx)
 
const DetectAddressHeadDetectParseAddress (DetectEngineCtx *de_ctx, const char *string, bool *contains_negation)
 

Detailed Description

Function Documentation

int DetectAddressAdd ( DetectAddress **  head,
DetectAddress ag 
)

Do a sorted insert, where the top of the list should be the biggest network/range.

XXX current sorting only works for overlapping nets

Parameters
headPointer to the list of DetectAddress.
agPointer to the DetectAddress that has to be added to the above list.
Return values
0On successfully inserting the DetectAddress.
-1On failure.

Definition at line 196 of file detect-engine-address.c.

References ADDRESS_EB, DetectAddressCmp(), Address_::family, head, DetectAddress_::ip, DetectAddressHead_::ipv4_head, DetectAddressHead_::ipv6_head, DetectAddress_::next, DetectAddress_::prev, and SCLogDebug.

Here is the call graph for this function:

void DetectAddressCleanupList ( DetectAddress head)

Frees a list of DetectAddress instances.

Parameters
headPointer to a list of DetectAddress instances to be freed.

Definition at line 165 of file detect-engine-address.c.

References DetectAddressFree(), DetectAddress_::next, and next.

Referenced by DetectAddressHeadCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectAddressCmp ( DetectAddress a,
DetectAddress b 
)

Used to compare 2 address ranges.

Parameters
aPointer to the first DetectAddressData to be compared.
bPointer to the second DetectAddressData to be compared.

Definition at line 1695 of file detect-engine-address.c.

References ADDRESS_ER, DetectAddressCmpIPv4(), DetectAddressCmpIPv6(), Address_::family, and DetectAddress_::ip.

Referenced by DetectAddressAdd(), DetectAddressInsert(), DetectAddressListsAreEqual(), DetectAddressLookupInList(), and DetectAddressMergeNot().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectAddress* DetectAddressCopy ( DetectAddress orig)

Copies the contents of one Address group in DetectAddress and returns a new instance of the DetectAddress that contains the copied address.

Parameters
origPointer to the instance of DetectAddress that contains the address data to be copied to the new instance.
Return values
agPointer to the new instance of DetectAddress that contains the copied address.

Definition at line 98 of file detect-engine-address.c.

References COPY_ADDRESS, DetectAddressInit(), DetectAddress_::flags, DetectAddress_::ip, and DetectAddress_::ip2.

Referenced by DetectAddressMergeNot(), and DetectAddressParseString().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectAddressFree ( DetectAddress ag)

Frees a DetectAddress instance.

Parameters
agPointer to the DetectAddress instance to be freed.

Definition at line 78 of file detect-engine-address.c.

References SCFree.

Referenced by DetectAddressCleanupList(), DetectAddressCutIPv4(), DetectAddressCutIPv6(), DetectAddressInsert(), DetectAddressJoinIPv4(), DetectAddressJoinIPv6(), DetectAddressMergeNot(), and DetectAddressParseString().

Here is the caller graph for this function:

void DetectAddressHeadCleanup ( DetectAddressHead gh)

Cleans a DetectAddressHead. The functions frees the address group heads(ipv4 and ipv6) inside the DetectAddressHead instance.

Parameters
ghPointer to the DetectAddressHead instance that has to be cleaned.

Definition at line 1592 of file detect-engine-address.c.

References DetectAddressCleanupList(), DetectAddressHead_::ipv4_head, and DetectAddressHead_::ipv6_head.

Referenced by DetectAddressHeadFree(), DetectAddressParseString(), DetectThresholdRegister(), and SCThresholdConfInitContext().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectAddressHeadFree ( DetectAddressHead gh)

Frees a DetectAddressHead instance.

Parameters
ghPointer to the DetectAddressHead instance to be freed.

Definition at line 1613 of file detect-engine-address.c.

References DetectAddressCutIPv4(), DetectAddressCutIPv6(), DetectAddressCutNotIPv4(), DetectAddressCutNotIPv6(), DetectAddressHeadCleanup(), Address_::family, DetectAddress_::ip, and SCFree.

Referenced by DetectAddressParse(), DetectAddressTestConfVars(), and DetectParseAddress().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectAddressHead* DetectAddressHeadInit ( void  )

Returns a new instance of DetectAddressHead.

Return values
ghPointer to the new instance of DetectAddressHead.

Definition at line 1574 of file detect-engine-address.c.

References SCMalloc, and unlikely.

Referenced by DetectAddressParse(), DetectAddressTestConfVars(), and DetectParseAddress().

Here is the caller graph for this function:

DetectAddress* DetectAddressInit ( void  )

Creates and returns a new instance of a DetectAddress.

Return values
agPointer to the newly created DetectAddress on success; NULL on failure.

Definition at line 63 of file detect-engine-address.c.

References SCMalloc, and unlikely.

Referenced by DetectAddressCopy(), DetectAddressCutIPv4(), DetectAddressCutIPv6(), DetectAddressCutNotIPv4(), DetectAddressCutNotIPv6(), DetectAddressJoinIPv4(), DetectAddressJoinIPv6(), and DetectAddressParseString().

Here is the caller graph for this function:

int DetectAddressInsert ( DetectEngineCtx de_ctx,
DetectAddressHead gh,
DetectAddress new 
)

Same as DetectAddressInsert, but then for inserting a address group object. This also makes sure SigGroupContainer lists are handled correctly.

Parameters
de_ctxPointer to the detection engine context.
ghPointer to the DetectAddressHead list to which it has to be inserted.
newPointer to the DetectAddress, that has to be inserted.
Return values
1On successfully inserting it.
-1On error.
0Not inserted, memory of new is freed.

Definition at line 292 of file detect-engine-address.c.

References ADDRESS_EB, ADDRESS_EQ, ADDRESS_ER, ADDRESS_ES, ADDRESS_GE, ADDRESS_GT, ADDRESS_LE, ADDRESS_LT, BUG_ON, DetectAddressCmp(), DetectAddressFree(), DetectAddressInsert(), head, DetectAddress_::next, DetectAddress_::prev, and SCLogDebug.

Referenced by DetectAddressInsert(), DetectAddressMergeNot(), and DetectAddressParseString().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectAddressJoin ( DetectEngineCtx de_ctx,
DetectAddress target,
DetectAddress source 
)

Join two addresses groups together.

Parameters
de_ctxPointer to the detection engine context.
targetPointer to the target address group.
sourcePointer to the source address group.
Return values
0On success.
-1On failure.

Definition at line 425 of file detect-engine-address.c.

References DetectAddressJoinIPv4(), DetectAddressJoinIPv6(), Address_::family, and DetectAddress_::ip.

Here is the call graph for this function:

bool DetectAddressListsAreEqual ( DetectAddress list1,
DetectAddress list2 
)

Checks if two address group lists are equal.

Parameters
list1Pointer to the first address group list.
list2Pointer to the second address group list.
Return values
trueOn success.
falseOn failure.

Definition at line 451 of file detect-engine-address.c.

References ADDRESS_EQ, DetectAddressCmp(), and DetectAddress_::next.

Referenced by SigMatchList2DataArray().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectAddress* DetectAddressLookupInHead ( const DetectAddressHead gh,
Address a 
)

Find the group matching address in a group head.

Parameters
ghPointer to the address group head(DetectAddressHead instance).
aPointer to an Address instance.
Return values
gOn success pointer to an DetectAddress if we find a match for the Address "a", in the DetectAddressHead "gh".

Definition at line 1939 of file detect-engine-address.c.

References DetectAddressMatch(), FALSE, Address_::family, DetectAddress_::ip, DetectAddress_::ip2, DetectAddressHead_::ipv4_head, DetectAddressHead_::ipv6_head, DetectAddress_::next, PrintInet(), SCEnter, SCLogDebug, SCLogInfo, SCReturnPtr, and TRUE.

Referenced by ThresholdIPPairTimeoutCheck().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectAddress* DetectAddressLookupInList ( DetectAddress head,
DetectAddress gr 
)

Used to check if a DetectAddress list contains an instance with a similar DetectAddress. The comparison done is not the one that checks the memory for the same instance, but one that checks that the two instances hold the same content.

Parameters
headPointer to the DetectAddress list.
adPointer to the DetectAddress that has to be checked for in the DetectAddress list.
Return values
curReturns a pointer to the DetectAddress on a match; NULL if no match.

Definition at line 125 of file detect-engine-address.c.

References ADDRESS_EQ, DetectAddressCmp(), and DetectAddress_::next.

Here is the call graph for this function:

void DetectAddressMapFree ( DetectEngineCtx de_ctx)

Definition at line 1440 of file detect-engine-address.c.

References DetectAddressMap_::address, DetectEngineCtx_::address_table, BUG_ON, DetectAddressMap_::contains_negation, HashListTableAdd(), HashListTableFree(), HashListTableLookup(), res, SCCalloc, SCFree, SCStrdup, and DetectAddressMap_::string.

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectAddressMapInit ( DetectEngineCtx de_ctx)

Definition at line 1429 of file detect-engine-address.c.

References DetectEngineCtx_::address_table, and HashListTableInit().

Referenced by DetectEngineInspectPktBufferGeneric().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectAddressMatch ( DetectAddress dd,
Address a 
)

Check if a particular address(ipv4 or ipv6) matches the address range in the DetectAddress instance.

We basically check that the address falls inbetween the address range in DetectAddress.

Parameters
ddPointer to the DetectAddress instance.
aPointer to an Address instance.
1On a match.
0On no match.

Definition at line 1847 of file detect-engine-address.c.

References AddressIPv6Ge(), AddressIPv6Le(), Address_::family, DetectAddress_::ip, DetectAddress_::ip2, SCEnter, SCLogDebug, SCNtohl, and SCReturnInt.

Referenced by DetectAddressLookupInHead().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectAddressMatchIPv4 ( const DetectMatchAddressIPv4 addrs,
uint16_t  addrs_cnt,
const Address a 
)

Match a packets address against a signatures addrs array.

Parameters
addrsarray of DetectMatchAddressIPv4's
addrs_cntarray size in members
apackets address
Return values
0no match
1match
Note
addresses in addrs are in host order
Todo:
array should be ordered, so we can break out of the loop

Definition at line 1722 of file detect-engine-address.c.

References DetectMatchAddressIPv4_::ip, DetectMatchAddressIPv4_::ip2, SCEnter, SCNtohl, and SCReturnInt.

Referenced by SigMatchSignaturesGetSgh().

Here is the caller graph for this function:

int DetectAddressMatchIPv6 ( const DetectMatchAddressIPv6 addrs,
uint16_t  addrs_cnt,
const Address a 
)

Match a packets address against a signatures addrs array.

Parameters
addrsarray of DetectMatchAddressIPv6's
addrs_cntarray size in members
apackets address
Return values
0no match
1match
Note
addresses in addrs are in host order
Todo:
array should be ordered, so we can break out of the loop

Definition at line 1757 of file detect-engine-address.c.

References DetectMatchAddressIPv6_::ip, DetectMatchAddressIPv6_::ip2, SCEnter, SCNtohl, and SCReturnInt.

Referenced by SigMatchSignaturesGetSgh().

Here is the caller graph for this function:

int DetectAddressParse ( const DetectEngineCtx de_ctx,
DetectAddressHead gh,
const char *  str 
)

Parses an address group sent as a character string and updates the DetectAddressHead sent as the argument with the relevant address ranges from the parsed string.

Parameters
ghPointer to the DetectAddressHead.
strPointer to the character string containing the address group that has to be parsed.
Return values
1On success. Contained negation.
0On success. Did not contain negation.
-1On failure.

Definition at line 1492 of file detect-engine-address.c.

References DetectAddressMap_::contains_negation, DetectAddressHeadFree(), DetectAddressHeadInit(), DetectAddressMergeNot(), DetectAddressHead_::ipv4_head, DetectAddressHead_::ipv6_head, and SCLogDebug.

Referenced by DetectParseAddress(), and SCThresholdConfInitContext().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectAddressPrint ( DetectAddress gr)

Prints the address data held by the DetectAddress. If the address data family is IPv4, we print the the ipv4 address and mask, and if the address data family is IPv6, we print the ipv6 address and mask.

Parameters
adPointer to the DetectAddress instance to be printed.

Definition at line 1898 of file detect-engine-address.c.

References Address_::family, DetectAddress_::ip, DetectAddress_::ip2, PrintInet(), and SCLogDebug.

Referenced by DetectAddressMergeNot(), DetectAddressParseString(), and DetectAddressPrintList().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectAddressPrintList ( DetectAddress head)

Prints the address data information for all the DetectAddress instances in the DetectAddress list sent as the argument.

Parameters
headPointer to a list of DetectAddress instances.

Definition at line 145 of file detect-engine-address.c.

References DetectAddressPrint(), DetectAddress_::next, and SCLogInfo.

Here is the call graph for this function:

void DetectAddressRegister ( void  )
int DetectAddressTestConfVars ( void  )

Definition at line 1315 of file detect-engine-address.c.

References CleanVariableResolveList(), ConfGetNode(), DetectAddressHeadFree(), DetectAddressHeadInit(), ConfNode_::name, next, SC_ERR_INVALID_YAML_CONF_ENTRY, SCLogDebug, SCLogError, TAILQ_FOREACH, TAILQ_HEAD_INITIALIZER, and ConfNode_::val.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectAddressTests ( void  )

Definition at line 4934 of file detect-engine-address.c.

References DetectAddressIPv4Tests(), DetectAddressIPv6Tests(), and UtRegisterTest().

Here is the call graph for this function:

const DetectAddressHead* DetectParseAddress ( DetectEngineCtx de_ctx,
const char *  string,
bool *  contains_negation 
)

Definition at line 1538 of file detect-engine-address.c.

References DetectAddressMap_::address, DetectAddressMap_::contains_negation, DetectAddressHeadFree(), DetectAddressHeadInit(), DetectAddressParse(), head, res, and SCLogDebug.

Referenced by SigMatchListSMBelongsTo().

Here is the call graph for this function:

Here is the caller graph for this function: