suricata
detect-engine-port.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "flow-var.h"
#include "util-cidr.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-rule-vars.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-port.h"
#include "conf.h"
#include "util-debug.h"
#include "util-error.h"
#include "pkt-var.h"
#include "host.h"
#include "util-profiling.h"
#include "util-var.h"
Include dependency graph for detect-engine-port.c:

Go to the source code of this file.

Functions

DetectPortPortParse (const char *str)
 Helper function for parsing port strings. More...
 
int DetectPortIsValidRange (char *port)
 Helper function to check if a parsed port is in the valid range of available ports. More...
 
void DetectPortFree (const DetectEngineCtx *de_ctx, DetectPort *dp)
 Free a DetectPort and its members. More...
 
void DetectPortPrintList (DetectPort *head)
 Helper function used to print the list of ports present in this DetectPort list. More...
 
void DetectPortCleanupList (const DetectEngineCtx *de_ctx, DetectPort *head)
 Free a DetectPort list and each of its members. More...
 
int DetectPortInsertCopy (DetectEngineCtx *de_ctx, DetectPort **head, DetectPort *new)
 Copy and insert the new DetectPort, with a copy list of sigs. More...
 
int DetectPortInsert (DetectEngineCtx *de_ctx, DetectPort **head, DetectPort *new)
 function for inserting a port group object. This also makes sure SigGroupContainer lists are handled correctly. More...
 
int DetectPortCmp (DetectPort *a, DetectPort *b)
 Function that compare port groups. More...
 
DetectPortDetectPortCopy (DetectEngineCtx *de_ctx, DetectPort *src)
 Function that return a copy of DetectPort src. More...
 
DetectPortDetectPortCopySingle (DetectEngineCtx *de_ctx, DetectPort *src)
 Function that return a copy of DetectPort src sigs. More...
 
void DetectPortPrint (DetectPort *dp)
 Helper function that print the DetectPort info. More...
 
DetectPortDetectPortLookupGroup (DetectPort *dp, uint16_t port)
 Function that find the group matching address in a group head. More...
 
DetectPortDetectPortLookupInList (DetectPort *head, DetectPort *gr)
 Used to check if a DetectPort list contains an instance with a similar DetectPort. The comparison done is not the one that checks the memory for the same instance, but one that checks that the two instances hold the same content. More...
 
int DetectPortJoin (DetectEngineCtx *de_ctx, DetectPort *target, DetectPort *source)
 Function to join the source group to the target and its members. More...
 
bool DetectPortListsAreEqual (DetectPort *list1, DetectPort *list2)
 Checks if two port group lists are equal. More...
 
int DetectPortTestConfVars (void)
 
int DetectPortParse (const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
 Function for parsing port strings. More...
 
int DetectPortHashInit (DetectEngineCtx *de_ctx)
 Initializes the hash table in the detection engine context to hold the DetectPort hash. More...
 
int DetectPortHashAdd (DetectEngineCtx *de_ctx, DetectPort *dp)
 Adds a DetectPort to the detection engine context DetectPort hash table. More...
 
DetectPortDetectPortHashLookup (DetectEngineCtx *de_ctx, DetectPort *dp)
 Used to lookup a DetectPort hash from the detection engine context DetectPort hash table. More...
 
void DetectPortHashFree (DetectEngineCtx *de_ctx)
 Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by DetectPortInit() function. More...
 
void DetectPortTests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Ports part of the detection engine.

Todo:

move this out of the detection plugin structure

more unittesting

Definition in file detect-engine-port.c.

Function Documentation

void DetectPortCleanupList ( const DetectEngineCtx de_ctx,
DetectPort head 
)

Free a DetectPort list and each of its members.

Parameters
headPointer to the DetectPort list head

Definition at line 124 of file detect-engine-port.c.

References DetectPortFree(), DetectPort_::next, and next.

Referenced by AppLayerProtoDetectPPRegister(), DetectEngineCtxFree(), DetectPortHashFree(), DetectPortListsAreEqual(), DetectPortParse(), DetectPortTestConfVars(), DetectSetupParseRegexes(), PortParse(), SigAddressCleanupStage1(), and SigFree().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortCmp ( DetectPort a,
DetectPort b 
)

Function that compare port groups.

Parameters
apointer to DetectPort "a"
bpointer to DetectPort "b"
Return values
PORT_XX(Port enum value, XX is EQ, ES, EB, LE, etc)
PORT_ERon error

Definition at line 580 of file detect-engine-port.c.

References BUG_ON, DetectPort_::flags, DetectPort_::port, DetectPort_::port2, PORT_EB, PORT_EQ, PORT_ER, PORT_ES, PORT_FLAG_ANY, PORT_GE, PORT_GT, PORT_LE, and PORT_LT.

Referenced by DetectPortHashFree(), DetectPortInsert(), DetectPortListsAreEqual(), DetectPortLookupInList(), and DetectSetupParseRegexes().

Here is the caller graph for this function:

DetectPort* DetectPortCopy ( DetectEngineCtx de_ctx,
DetectPort src 
)

Function that return a copy of DetectPort src.

Parameters
de_ctxPointer to the current Detection Engine Context
srcPointer to a DetectPort group to copy
Return values
Pointerto a DetectPort instance (copy of src)
NULLon error

Definition at line 636 of file detect-engine-port.c.

References DetectPortCopy(), dst, DetectPort_::next, DetectPort_::port, DetectPort_::port2, and DetectPort_::prev.

Referenced by DetectPortCopy(), and DetectPortHashFree().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectPort* DetectPortCopySingle ( DetectEngineCtx de_ctx,
DetectPort src 
)

Function that return a copy of DetectPort src sigs.

Parameters
de_ctxPointer to the current Detection Engine Context
srcPointer to a DetectPort group to copy
Return values
Pointerto a DetectPort instance (copy of src)
NULLon error

Definition at line 670 of file detect-engine-port.c.

References dst, DetectPort_::port, DetectPort_::port2, DetectPort_::sh, and SigGroupHeadCopySigs().

Referenced by DetectPortInsertCopy(), DetectPortListsAreEqual(), and PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectPortFree ( const DetectEngineCtx de_ctx,
DetectPort dp 
)

Free a DetectPort and its members.

Parameters
dpPointer to the DetectPort that has to be freed.

Definition at line 83 of file detect-engine-port.c.

References DetectPort_::flags, PORT_SIGGROUPHEAD_COPY, SCFree, DetectPort_::sh, and SigGroupHeadFree().

Referenced by CreateGroupedPortList(), DetectPortCleanupList(), DetectPortHashFree(), DetectPortInsert(), DetectPortIsValidRange(), and DetectPortListsAreEqual().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortHashAdd ( DetectEngineCtx de_ctx,
DetectPort dp 
)

Adds a DetectPort to the detection engine context DetectPort hash table.

Parameters
de_ctxPointer to the detection engine context.
dpPointer to the DetectPort.
Return values
ret0 on Successfully adding the DetectPort; -1 on failure.

Definition at line 1569 of file detect-engine-port.c.

References DetectEngineCtx_::dport_hash_table, and HashListTableAdd().

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortHashInit ( DetectEngineCtx de_ctx)

Initializes the hash table in the detection engine context to hold the DetectPort hash.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 1546 of file detect-engine-port.c.

References DetectEngineCtx_::dport_hash_table, and HashListTableInit().

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectPort* DetectPortHashLookup ( DetectEngineCtx de_ctx,
DetectPort dp 
)

Used to lookup a DetectPort hash from the detection engine context DetectPort hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the DetectPort.
Return values
rsghOn success a pointer to the DetectPort if the DetectPort is found in the hash table; NULL on failure.

Definition at line 1585 of file detect-engine-port.c.

References DetectEngineCtx_::dport_hash_table, HashListTableLookup(), SCEnter, and SCReturnPtr.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortInsert ( DetectEngineCtx de_ctx,
DetectPort **  head,
DetectPort new 
)

function for inserting a port group object. This also makes sure SigGroupContainer lists are handled correctly.

Parameters
de_ctxPointer to the current detection engine context
headPointer to the DetectPort list head
dpDetectPort to search in the DetectPort list
Return values
1inserted
0not inserted, memory of new is freed
-1error

Definition at line 170 of file detect-engine-port.c.

References BUG_ON, DetectPortCmp(), DetectPortFree(), DetectPortInsert(), DetectPortPrint(), DetectPort_::next, DetectPort_::port, DetectPort_::port2, PORT_EB, PORT_EQ, PORT_ER, PORT_ES, PORT_GE, PORT_GT, PORT_LE, PORT_LT, DetectPort_::prev, SCLogDebug, SCLogDebugEnabled(), DetectPort_::sh, SigGroupHeadClearSigs(), and SigGroupHeadCopySigs().

Referenced by DetectPortHashFree(), DetectPortInsert(), DetectPortInsertCopy(), DetectPortListsAreEqual(), and PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortInsertCopy ( DetectEngineCtx de_ctx,
DetectPort **  head,
DetectPort new 
)

Copy and insert the new DetectPort, with a copy list of sigs.

Parameters
de_ctxPointer to the current detection engine context
headPointer to the DetectPort list head
newPointer to DetectPort to search in the DetectPort list
Return values
0if dp is added correctly

Definition at line 148 of file detect-engine-port.c.

References DetectPortCopySingle(), and DetectPortInsert().

Here is the call graph for this function:

int DetectPortIsValidRange ( char *  port)

Helper function to check if a parsed port is in the valid range of available ports.

Parameters
strPointer to the port string
Return values
1if port is in the valid range
0if invalid

Definition at line 1466 of file detect-engine-port.c.

References HashListTable_::array_size, DetectPortFree(), DetectPort_::port, DetectPort_::port2, and SCLogDebug.

Referenced by PortParse().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortJoin ( DetectEngineCtx de_ctx,
DetectPort target,
DetectPort source 
)

Function to join the source group to the target and its members.

Parameters
de_ctxPointer to the current Detection Engine Context
targetPointer to DetectPort group where the source is joined
sourcePointer to DetectPort group that will join into the target
Return values
-1on error
0on success

Definition at line 792 of file detect-engine-port.c.

References DetectPort_::port, DetectPort_::port2, DetectPort_::sh, and SigGroupHeadCopySigs().

Here is the call graph for this function:

bool DetectPortListsAreEqual ( DetectPort list1,
DetectPort list2 
)
DetectPort* DetectPortLookupGroup ( DetectPort dp,
uint16_t  port 
)

Function that find the group matching address in a group head.

Parameters
dpPointer to DetectPort group where we try to find the group
portport to search/lookup
Return values
Pointerto the DetectPort group of our port if it matched
NULLif port is not in the list

Definition at line 737 of file detect-engine-port.c.

References DetectPort_::next.

Referenced by DetectPortHashFree(), IPOnlyMatchPacket(), and SigMatchSignaturesGetSgh().

Here is the caller graph for this function:

DetectPort* DetectPortLookupInList ( DetectPort head,
DetectPort gr 
)

Used to check if a DetectPort list contains an instance with a similar DetectPort. The comparison done is not the one that checks the memory for the same instance, but one that checks that the two instances hold the same content.

Parameters
headPointer to the DetectPort list.
adPointer to the DetectPort that has to be checked for in the DetectPort list.
Return values
curReturns a pointer to the DetectPort on a match; NULL if no match.

Definition at line 768 of file detect-engine-port.c.

References DetectPortCmp(), DetectPort_::next, and PORT_EQ.

Here is the call graph for this function:

int DetectPortParse ( const DetectEngineCtx de_ctx,
DetectPort **  head,
const char *  str 
)

Function for parsing port strings.

Parameters
headPointer to the head of the DetectPort group list
strPointer to the port string
Return values
0on success
-1on error

Definition at line 1355 of file detect-engine-port.c.

References DetectPortCleanupList(), and SCLogDebug.

Referenced by AppLayerProtoDetectPPRegister(), CreateGroupedPortList(), DetectEngineCtxFree(), DetectPortHashFree(), DetectSetupParseRegexes(), and SigMatchListSMBelongsTo().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectPortPrint ( DetectPort dp)

Helper function that print the DetectPort info.

Return values
none

Definition at line 713 of file detect-engine-port.c.

References DetectPort_::flags, DetectPort_::port, DetectPort_::port2, PORT_FLAG_ANY, and SCLogDebug.

Referenced by CreateGroupedPortList(), DetectPortHashFree(), DetectPortInsert(), DetectPortListsAreEqual(), DetectPortPrintList(), and DetectSetupParseRegexes().

Here is the caller graph for this function:

void DetectPortPrintList ( DetectPort head)

Helper function used to print the list of ports present in this DetectPort list.

Parameters
headPointer to the DetectPort list head

Definition at line 103 of file detect-engine-port.c.

References DetectPortPrint(), DetectPort_::next, and SCLogDebug.

Referenced by CreateGroupedPortList().

Here is the call graph for this function:

Here is the caller graph for this function:

int DetectPortTestConfVars ( void  )

Definition at line 1281 of file detect-engine-port.c.

References CleanVariableResolveList(), ConfGetNode(), DetectPortCleanupList(), ConfNode_::name, next, SC_ERR_INVALID_YAML_CONF_ENTRY, SCLogDebug, SCLogError, TAILQ_FOREACH, TAILQ_HEAD_INITIALIZER, and ConfNode_::val.

Referenced by PostRunDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

void DetectPortTests ( void  )

Definition at line 2771 of file detect-engine-port.c.

References UtRegisterTest().

Here is the call graph for this function:

DetectPort * PortParse ( const char *  str)

Helper function for parsing port strings.

Parameters
strPointer to the port string
Return values
DetectPortpointer of the parse string on success
NULLon error

Definition at line 1392 of file detect-engine-port.c.

References DetectPortCleanupList(), DetectPortIsValidRange(), DetectPort_::flags, DetectPort_::port, DetectPort_::port2, PORT_FLAG_NOT, and strlcpy().

Referenced by DetectPortListsAreEqual().

Here is the call graph for this function:

Here is the caller graph for this function: