#include "suricata-common.h"
#include "suricata.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-alert.h"
#include "detect-engine-threshold.h"
#include "detect-engine-tag.h"
#include "decode.h"
#include "packet.h"
#include "flow.h"
#include "flow-private.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "action-globals.h"
#include "capture-hooks.h"
#include "tests/detect-engine-alert.c"

Include dependency graph for detect-engine-alert.c:

Functions
void	PacketAlertTagInit (void)

int	PacketAlertCheck (Packet *p, uint32_t sid)
	Check if a certain sid alerted, this is used in the test functions. More...

void	AlertQueueInit (DetectEngineThreadCtx *det_ctx)

void	AlertQueueFree (DetectEngineThreadCtx *det_ctx)

void	AlertQueueAppendAppTx (DetectEngineThreadCtx det_ctx, const Signature s, Packet *p, uint64_t tx_id, uint8_t sub_state, uint8_t alert_flags)
	Append signature to local packet alert queue for later preprocessing. More...

void	AlertQueueAppendAppTxFromPacket (DetectEngineThreadCtx det_ctx, const Signature s, Packet *p, uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
	Append signature to local packet alert queue for later preprocessing This does not automatically set PACKET_ALERT_FLAG_STATE_MATCH as this comes from the packet alert path. More...

void	AlertQueueAppendPacket (DetectEngineThreadCtx det_ctx, const Signature s, Packet *p, uint8_t alert_flags)
	Append signature to local packet alert queue for later preprocessing. More...

void	PacketAlertFinalize (const DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, Packet *p)
	Check the threshold of the sigs that match, set actions, break on pass action This function iterate the packet alerts array, removing those that didn't match the threshold, and those that match after a signature with the action "pass". The array is sorted by action priority/order. More...

Function Documentation

◆ AlertQueueAppendAppTx()

void AlertQueueAppendAppTx	(	DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Packet *	p,
		uint64_t	tx_id,
		uint8_t	sub_state,
		uint8_t	alert_flags
	)

Append signature to local packet alert queue for later preprocessing.

Definition at line 425 of file detect-engine-alert.c.

References PACKET_ALERT_FLAG_STATE_MATCH, and PACKET_ALERT_FLAG_TX.

◆ AlertQueueAppendAppTxFromPacket()

void AlertQueueAppendAppTxFromPacket	(	DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Packet *	p,
		uint64_t	tx_id,
		const uint8_t	sub_state,
		uint8_t	alert_flags
	)

Append signature to local packet alert queue for later preprocessing This does not automatically set PACKET_ALERT_FLAG_STATE_MATCH as this comes from the packet alert path.

Definition at line 437 of file detect-engine-alert.c.

References PACKET_ALERT_FLAG_TX.

◆ AlertQueueAppendPacket()

void AlertQueueAppendPacket	(	DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Packet *	p,
		uint8_t	alert_flags
	)

Append signature to local packet alert queue for later preprocessing.

Definition at line 447 of file detect-engine-alert.c.

◆ AlertQueueFree()

void AlertQueueFree ( DetectEngineThreadCtx * det_ctx )

Definition at line 282 of file detect-engine-alert.c.

References DetectEngineThreadCtx_::alert_queue, DetectEngineThreadCtx_::alert_queue_capacity, and SCFree.

◆ AlertQueueInit()

void AlertQueueInit ( DetectEngineThreadCtx * det_ctx )

Definition at line 269 of file detect-engine-alert.c.

References DetectEngineThreadCtx_::alert_queue, DetectEngineThreadCtx_::alert_queue_capacity, DetectEngineThreadCtx_::alert_queue_size, FatalError, packet_alert_max, SCCalloc, and SCLogDebug.

◆ PacketAlertCheck()

int PacketAlertCheck	(	Packet *	p,
		uint32_t	sid
	)

Check if a certain sid alerted, this is used in the test functions.

Parameters

p	Packet on which we want to check if the signature alerted or not
sid	Signature id of the signature that has to be checked for a match

Return values

match A value > 0 on a match; 0 on no match

Definition at line 144 of file detect-engine-alert.c.

References PacketAlerts_::alerts, Packet_::alerts, BUG_ON, PacketAlerts_::cnt, Signature_::id, p, and PacketAlert_::s.

Referenced by UTHCheckPacketMatchResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the caller graph for this function:

◆ PacketAlertFinalize()

void PacketAlertFinalize	(	const DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		Packet *	p
	)

Check the threshold of the sigs that match, set actions, break on pass action This function iterate the packet alerts array, removing those that didn't match the threshold, and those that match after a signature with the action "pass". The array is sorted by action priority/order.

Parameters

de_ctx	detection engine context
det_ctx	detection engine thread context
p	pointer to the packet

Definition at line 831 of file detect-engine-alert.c.

References DetectEngineThreadCtx_::alert_queue_size, and SCEnter.

◆ PacketAlertTagInit()

void PacketAlertTagInit ( void )

Definition at line 48 of file detect-engine-alert.c.

Functions