suricata
Functions
detect-engine-build.h File Reference

Go to the source code of this file.

Functions

void PacketCreateMask (Packet *p, SignatureMask *mask, AppProto alproto, bool app_decoder_events)
 
int SignatureIsFilestoring (const Signature *)
 Check if a signature contains the filestore keyword. More...
 
int SignatureIsFilemagicInspecting (const Signature *)
 Check if a signature contains the filemagic keyword. More...
 
int SignatureIsFileMd5Inspecting (const Signature *)
 Check if a signature contains the filemd5 keyword. More...
 
int SignatureIsFileSha1Inspecting (const Signature *s)
 Check if a signature contains the filesha1 keyword. More...
 
int SignatureIsFileSha256Inspecting (const Signature *s)
 Check if a signature contains the filesha256 keyword. More...
 
void SignatureSetType (DetectEngineCtx *de_ctx, Signature *s)
 
int SigPrepareStage1 (DetectEngineCtx *de_ctx)
 Preprocess signature, classify ip-only, etc, build sig array. More...
 
int SigPrepareStage2 (DetectEngineCtx *de_ctx)
 Fill the global src group head, with the sigs included. More...
 
int SigPrepareStage3 (DetectEngineCtx *de_ctx)
 
int SigPrepareStage4 (DetectEngineCtx *de_ctx)
 finalize preparing sgh's More...
 
int SigAddressCleanupStage1 (DetectEngineCtx *de_ctx)
 
void SigCleanSignatures (DetectEngineCtx *)
 
int SigGroupBuild (DetectEngineCtx *)
 Convert the signature list into the runtime match structure. More...
 
int SigGroupCleanup (DetectEngineCtx *de_ctx)
 

Function Documentation

◆ PacketCreateMask()

void PacketCreateMask ( Packet *  p,
SignatureMask *  mask,
AppProto  alproto,
bool  app_decoder_events 
)

Definition at line 401 of file detect-engine-build.c.

References Packet_::app_layer_events, AppLayerDecoderEvents_::cnt, PacketEngineEvents_::cnt, Packet_::events, Packet_::flags, Packet_::payload_len, PKT_DETECT_HAS_STREAMDATA, PKT_IS_PSEUDOPKT, PKT_NOPAYLOAD_INSPECTION, SCLogDebug, SIG_MASK_REQUIRE_ENGINE_EVENT, SIG_MASK_REQUIRE_NO_PAYLOAD, SIG_MASK_REQUIRE_PAYLOAD, and SIG_MASK_REQUIRE_REAL_PKT.

◆ SigAddressCleanupStage1()

int SigAddressCleanupStage1 ( DetectEngineCtx *  de_ctx)

Definition at line 1967 of file detect-engine-build.c.

References BUG_ON, de_ctx, DetectEngineCtx_::decoder_event_sgh, DetectPortCleanupList(), DetectEngineCtx_::flow_gh, FLOW_STATES, DetectEngineCtx_::io_ctx, IPOnlyDeinit(), DetectEngineCtx_::pre_flow_sgh, DetectEngineCtx_::pre_stream_sgh, SCFree, SCLogDebug, DetectEngineLookupFlow_::sgh, DetectEngineCtx_::sgh_array, DetectEngineCtx_::sgh_array_cnt, DetectEngineCtx_::sgh_array_size, SigGroupHeadFree(), DetectEngineLookupFlow_::tcp, and DetectEngineLookupFlow_::udp.

Referenced by SigGroupCleanup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigCleanSignatures()

void SigCleanSignatures ( DetectEngineCtx *  )

Definition at line 56 of file detect-engine-build.c.

References de_ctx, DetectEngineResetMaxSigId(), Signature_::next, DetectEngineCtx_::sig_list, and SigFree().

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupBuild()

int SigGroupBuild ( DetectEngineCtx *  de_ctx)

Convert the signature list into the runtime match structure.

Parameters
de_ctxPointer to the Detection Engine Context whose Signatures have to be processed
Return values
0On Success.
-1On failure.

Definition at line 2194 of file detect-engine-build.c.

References de_ctx, DetectSetFastPatternAndItsId(), Signature_::iid, Signature_::next, DetectEngineCtx_::sig_list, and DetectEngineCtx_::signum.

Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupCleanup()

int SigGroupCleanup ( DetectEngineCtx *  de_ctx)

Definition at line 2265 of file detect-engine-build.c.

References de_ctx, and SigAddressCleanupStage1().

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SignatureIsFilemagicInspecting()

int SignatureIsFilemagicInspecting ( const Signature *  s)

Check if a signature contains the filemagic keyword.

Parameters
ssignature
Return values
0no
1yes

Definition at line 120 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_MAGIC.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

◆ SignatureIsFileMd5Inspecting()

int SignatureIsFileMd5Inspecting ( const Signature *  s)

Check if a signature contains the filemd5 keyword.

Parameters
ssignature
Return values
0no
1yes

Definition at line 139 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_MD5.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

◆ SignatureIsFileSha1Inspecting()

int SignatureIsFileSha1Inspecting ( const Signature *  s)

Check if a signature contains the filesha1 keyword.

Parameters
ssignature
Return values
0no
1yes

Definition at line 155 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_SHA1.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

◆ SignatureIsFileSha256Inspecting()

int SignatureIsFileSha256Inspecting ( const Signature *  s)

Check if a signature contains the filesha256 keyword.

Parameters
ssignature
Return values
0no
1yes

Definition at line 171 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_SHA256.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

◆ SignatureIsFilestoring()

int SignatureIsFilestoring ( const Signature *  s)

Check if a signature contains the filestore keyword.

Parameters
ssignature
Return values
0no
1yes

Definition at line 101 of file detect-engine-build.c.

References Signature_::flags, and SIG_FLAG_FILESTORE.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

◆ SignatureSetType()

void SignatureSetType ( DetectEngineCtx *  de_ctx,
Signature *  s 
)

Definition at line 1645 of file detect-engine-build.c.

References BUG_ON, SignatureInitData_::hook, Signature_::id, Signature_::init_data, SCLogDebug, SCReturn, SIG_TYPE_APP_TX, SIG_TYPE_NOT_SET, SIGNATURE_HOOK_TYPE_APP, SignatureHook_::type, and Signature_::type.

◆ SigPrepareStage1()

int SigPrepareStage1 ( DetectEngineCtx *  de_ctx)

Preprocess signature, classify ip-only, etc, build sig array.

Parameters
de_ctxPointer to the Detection Engine Context
Return values
0on success
-1on failure

Definition at line 1723 of file detect-engine-build.c.

◆ SigPrepareStage2()

int SigPrepareStage2 ( DetectEngineCtx *  de_ctx)

Fill the global src group head, with the sigs included.

Parameters
de_ctxPointer to the Detection Engine Context whose Signatures have to be processed
Return values
0On success
-1On failure

Definition at line 1877 of file detect-engine-build.c.

References de_ctx, DetectEngineCtx_::flow_gh, DetectEngineCtx_::io_ctx, IPOnlyInit(), SCLogDebug, and DetectEngineLookupFlow_::tcp.

Here is the call graph for this function:

◆ SigPrepareStage3()

int SigPrepareStage3 ( DetectEngineCtx *  de_ctx)

Definition at line 1953 of file detect-engine-build.c.

◆ SigPrepareStage4()

int SigPrepareStage4 ( DetectEngineCtx *  de_ctx)

finalize preparing sgh's

Definition at line 2050 of file detect-engine-build.c.

References cnt, de_ctx, DetectEngineCtx_::decoder_event_sgh, SigGroupHead_::filestore_cnt, SigGroupHead_::id, MpmStoreReportStats(), PrefilterSetupRuleGroup(), SCConfGetBool(), SCEnter, SCLogDebug, SCLogPerf, DetectEngineCtx_::sgh_array, DetectEngineCtx_::sgh_array_cnt, and SigGroupHeadSetupFiles().

Here is the call graph for this function: