#include "suricata-common.h"
#include "decode.h"
#include "detect.h"

Include dependency graph for detect-engine-alert.h:

This graph shows which files directly or indirectly include this file:

Functions
void	PacketAlertFinalize (DetectEngineCtx , DetectEngineThreadCtx , Packet *)
	Check the threshold of the sigs that match, set actions, break on pass action This function iterate the packet alerts array, removing those that didn't match the threshold, and those that match after a signature with the action "pass". The array is sorted by action priority/order. More...

int	PacketAlertAppend (DetectEngineThreadCtx , const Signature , Packet *, uint64_t tx_id, uint8_t)
	append a signature match to a packet More...

int	PacketAlertCheck (Packet *, uint32_t)
	Check if a certain sid alerted, this is used in the test functions. More...

int	PacketAlertRemove (Packet *, uint16_t)
	Remove alert from the p->alerts.alerts array at pos. More...

void	PacketAlertTagInit (void)

PacketAlert *	PacketAlertGetTag (void)

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file detect-engine-alert.h.

Function Documentation

int PacketAlertAppend	(	DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Packet *	p,
		uint64_t	tx_id,
		uint8_t	flags
	)

append a signature match to a packet

Parameters

det_ctx	thread detection engine ctx
s	the signature that matched
p	packet
flags	alert flags

Definition at line 188 of file detect-engine-alert.c.

References PacketAlert_::action, Signature_::action, PacketAlerts_::alerts, Packet_::alerts, PacketAlerts_::cnt, flags, PacketAlert_::flags, Signature_::id, PacketAlert_::num, Signature_::num, PACKET_ALERT_MAX, PacketAlert_::s, SCLogDebug, tx_id, and PacketAlert_::tx_id.

Referenced by IPOnlyMatchPacket(), and SigMatchSignaturesGetSgh().

Here is the caller graph for this function:

int PacketAlertCheck	(	Packet *	p,
		uint32_t	sid
	)

Check if a certain sid alerted, this is used in the test functions.

Parameters

p	Packet on which we want to check if the signature alerted or not
sid	Signature id of the signature that thas to be checked for a match

Return values

match A value > 0 on a match; 0 on no match

Definition at line 138 of file detect-engine-alert.c.

References PacketAlerts_::alerts, Packet_::alerts, PacketAlerts_::cnt, Signature_::id, and PacketAlert_::s.

Referenced by DetectAckRegister(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDetectionFilterRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineInspectStream(), DetectEngineStateResetTxs(), DetectFastPatternRegister(), DetectFlowFree(), DetectFlowintFree(), DetectFragOffsetFree(), DetectFtpbounceRegister(), DetectHostbitFree(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectIcmpIdFree(), DetectIcmpSeqFree(), DetectICodeFree(), DetectIPProtoRemoveAllSMs(), DetectITypeFree(), DetectL3ProtoRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectProtoContainsProto(), DetectReplaceFreeInternal(), DetectRpcFree(), DetectSameipRegister(), DetectSetupParseRegexes(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectTemplateRustBufferRegister(), DetectThresholdRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), MpmACRegister(), MpmACTileRegister(), RegisterModbusParsers(), SCACBSPrintInfo(), SCThresholdConfParseFile(), SigParseApplyDsizeToContent(), SMTPParserCleanup(), UTHCheckPacketMatchResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the caller graph for this function:

void PacketAlertFinalize	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		Packet *	p
	)

Check the threshold of the sigs that match, set actions, break on pass action This function iterate the packet alerts array, removing those that didn't match the threshold, and those that match after a signature with the action "pass". The array is sorted by action priority/order.

Parameters