suricata
detect-engine-address.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

DetectAddressDetectAddressInit (void)
 Creates and returns a new instance of a DetectAddress. More...
 
void DetectAddressFree (DetectAddress *)
 Frees a DetectAddress instance. More...
 
DetectAddressDetectAddressCopy (DetectAddress *)
 copy a DetectAddress More...
 
int DetectAddressParse (const DetectEngineCtx *, DetectAddressHead *, const char *)
 Parses an address group sent as a character string and updates the DetectAddressHead sent as the argument with the relevant address ranges from the parsed string. More...
 
void DetectAddressHeadCleanup (DetectAddressHead *)
 Cleans a DetectAddressHead. The functions frees the address group heads(ipv4 and ipv6) inside the DetectAddressHead instance. More...
 
bool DetectAddressListsAreEqual (DetectAddress *list1, DetectAddress *list2)
 Checks if two address group lists are equal. More...
 
DetectAddressDetectAddressLookupInHead (const DetectAddressHead *, Address *)
 Find the group matching address in a group head. More...
 
int DetectAddressCmp (DetectAddress *, DetectAddress *)
 Used to compare 2 address ranges. More...
 
int DetectAddressMatchIPv4 (const DetectMatchAddressIPv4 *, uint16_t, const Address *)
 Match a packets address against a signatures addrs array. More...
 
int DetectAddressMatchIPv6 (const DetectMatchAddressIPv6 *, uint16_t, const Address *)
 Match a packets address against a signatures addrs array. More...
 
int DetectAddressTestConfVars (void)
 
void DetectAddressTests (void)
 
int DetectAddressMapInit (DetectEngineCtx *de_ctx)
 
void DetectAddressMapFree (DetectEngineCtx *de_ctx)
 
const DetectAddressHeadDetectParseAddress (DetectEngineCtx *de_ctx, const char *string, bool *contains_negation)
 

Detailed Description

Function Documentation

◆ DetectAddressCmp()

int DetectAddressCmp ( DetectAddress a,
DetectAddress b 
)

Used to compare 2 address ranges.

Parameters
aPointer to the first DetectAddressData to be compared.
bPointer to the second DetectAddressData to be compared.

Definition at line 1562 of file detect-engine-address.c.

References ADDRESS_ER, DetectAddressCmpIPv4(), DetectAddressCmpIPv6(), Address_::family, and DetectAddress_::ip.

Referenced by DetectAddressListsAreEqual().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectAddressCopy()

DetectAddress* DetectAddressCopy ( DetectAddress orig)

copy a DetectAddress

Parameters
origPointer to the instance of DetectAddress that contains the address data to be copied to the new instance.
Return values
agPointer to the new instance of DetectAddress that contains the copied address.

Definition at line 127 of file detect-engine-address.c.

References COPY_ADDRESS, DetectAddressInit(), DetectAddress_::flags, DetectAddress_::ip, and DetectAddress_::ip2.

Referenced by DetectThresholdDataCopy().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectAddressFree()

void DetectAddressFree ( DetectAddress ag)

Frees a DetectAddress instance.

Parameters
agPointer to the DetectAddress instance to be freed.

Definition at line 82 of file detect-engine-address.c.

References SCFree.

Referenced by DetectAddressCutIPv4().

Here is the caller graph for this function:

◆ DetectAddressHeadCleanup()

void DetectAddressHeadCleanup ( DetectAddressHead gh)

Cleans a DetectAddressHead. The functions frees the address group heads(ipv4 and ipv6) inside the DetectAddressHead instance.

Parameters
ghPointer to the DetectAddressHead instance that has to be cleaned.

Definition at line 1476 of file detect-engine-address.c.

References DetectAddressHead_::ipv4_head.

◆ DetectAddressInit()

DetectAddress* DetectAddressInit ( void  )

Creates and returns a new instance of a DetectAddress.

Return values
agPointer to the newly created DetectAddress on success; NULL on failure.

Definition at line 69 of file detect-engine-address.c.

References SCCalloc, and unlikely.

Referenced by DetectAddressCopy(), DetectAddressCutIPv4(), and DetectAddressCutNotIPv4().

Here is the caller graph for this function:

◆ DetectAddressListsAreEqual()

bool DetectAddressListsAreEqual ( DetectAddress list1,
DetectAddress list2 
)

Checks if two address group lists are equal.

Parameters
list1Pointer to the first address group list.
list2Pointer to the second address group list.
Return values
trueOn success.
falseOn failure.

Definition at line 349 of file detect-engine-address.c.

References ADDRESS_EQ, DetectAddressCmp(), and DetectAddress_::next.

Here is the call graph for this function:

◆ DetectAddressLookupInHead()

DetectAddress* DetectAddressLookupInHead ( const DetectAddressHead gh,
Address a 
)

Find the group matching address in a group head.

Parameters
ghPointer to the address group head(DetectAddressHead instance).
aPointer to an Address instance.
Return values
gOn success pointer to an DetectAddress if we find a match for the Address "a", in the DetectAddressHead "gh".

Definition at line 1798 of file detect-engine-address.c.

References Address_::family, DetectAddressHead_::ipv4_head, DetectAddressHead_::ipv6_head, DetectAddress_::next, SCEnter, SCLogDebug, and SCReturnPtr.

◆ DetectAddressMapFree()

void DetectAddressMapFree ( DetectEngineCtx de_ctx)

Definition at line 1337 of file detect-engine-address.c.

References DetectEngineCtx_::address_table, de_ctx, and HashListTableFree().

Here is the call graph for this function:

◆ DetectAddressMapInit()

int DetectAddressMapInit ( DetectEngineCtx de_ctx)

Definition at line 1326 of file detect-engine-address.c.

References DetectEngineCtx_::address_table, de_ctx, and HashListTableInit().

Here is the call graph for this function:

◆ DetectAddressMatchIPv4()

int DetectAddressMatchIPv4 ( const DetectMatchAddressIPv4 addrs,
uint16_t  addrs_cnt,
const Address a 
)

Match a packets address against a signatures addrs array.

Parameters
addrsarray of DetectMatchAddressIPv4's
addrs_cntarray size in members
apackets address
Return values
0no match
1match
Note
addresses in addrs are in host order
Todo:
array should be ordered, so we can break out of the loop

Definition at line 1589 of file detect-engine-address.c.

References SCEnter, SCNtohl, and SCReturnInt.

◆ DetectAddressMatchIPv6()

int DetectAddressMatchIPv6 ( const DetectMatchAddressIPv6 addrs,
uint16_t  addrs_cnt,
const Address a 
)

Match a packets address against a signatures addrs array.

Parameters
addrsarray of DetectMatchAddressIPv6's
addrs_cntarray size in members
apackets address
Return values
0no match
1match
Note
addresses in addrs are in host order
Todo:
array should be ordered, so we can break out of the loop

Definition at line 1622 of file detect-engine-address.c.

References SCEnter, SCNtohl, and SCReturnInt.

◆ DetectAddressParse()

int DetectAddressParse ( const DetectEngineCtx de_ctx,
DetectAddressHead gh,
const char *  str 
)

Parses an address group sent as a character string and updates the DetectAddressHead sent as the argument with the relevant address ranges from the parsed string.

Parameters
de_ctxPointer to the detection engine context
ghPointer to the DetectAddressHead.
strPointer to the character string containing the address group that has to be parsed.
Return values
1On success. Contained negation.
0On success. Did not contain negation.
-1On failure.

Definition at line 1394 of file detect-engine-address.c.

References SCLogDebug, and str.

◆ DetectAddressTestConfVars()

int DetectAddressTestConfVars ( void  )

Definition at line 1217 of file detect-engine-address.c.

References ConfGetNode(), ConfNode_::name, next, SCLogDebug, TAILQ_FOREACH, TAILQ_HEAD_INITIALIZER, and ConfNode_::val.

Here is the call graph for this function:

◆ DetectAddressTests()

void DetectAddressTests ( void  )

◆ DetectParseAddress()

const DetectAddressHead* DetectParseAddress ( DetectEngineCtx de_ctx,
const char *  string,
bool *  contains_negation 
)

Definition at line 1434 of file detect-engine-address.c.