suricata
detect-engine-port.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_DETECT_PORT_H
25 #define SURICATA_DETECT_PORT_H
26 
27 #include "interval-tree.h"
28 #include "detect.h"
29 
30 typedef struct SCPortIntervalNode {
31  uint16_t port; /* low port of a port range */
32  uint16_t port2; /* high port of a port range */
33  uint16_t max; /* max value of the high port in the subtree rooted at this node */
34 
35  struct SigGroupHead_ *sh; /* SGHs corresponding to this port */
36 
37  IRB_ENTRY(SCPortIntervalNode) irb; /* parent entry of the interval tree */
39 
40 IRB_HEAD(PI, SCPortIntervalNode); /* head of the interval tree */
42  SCPortIntervalCompare); /* prototype definition of the interval tree */
43 
44 typedef struct SCPortIntervalTree_ {
45  struct PI tree;
48 
53  DetectEngineCtx *, const uint16_t, const uint16_t, const struct PI *, DetectPort **);
54 
55 /* prototypes */
56 int DetectPortParse(const DetectEngineCtx *, DetectPort **head, const char *str);
57 
61 
62 DetectPort *DetectPortLookupGroup(DetectPort *dp, uint16_t port);
63 
64 bool DetectPortListsAreEqual(DetectPort *list1, DetectPort *list2);
65 
71 
72 int DetectPortTestConfVars(void);
73 
78 
79 #ifdef UNITTESTS
80 void DetectPortTests(void);
81 #endif
82 
83 #endif /* SURICATA_DETECT_PORT_H */
SCPortIntervalNode::max
uint16_t max
Definition: detect-engine-port.h:33
IRB_PROTOTYPE
IRB_PROTOTYPE(PI, SCPortIntervalNode, irb, SCPortIntervalCompare)
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1451
DetectPortTestConfVars
int DetectPortTestConfVars(void)
Definition: detect-engine-port.c:1106
SCPortIntervalNode::sh
struct SigGroupHead_ * sh
Definition: detect-engine-port.h:35
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:839
DetectPortLookupGroup
DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port)
Function that find the group matching port in a group head.
Definition: detect-engine-port.c:613
DetectPortPrintList
void DetectPortPrintList(DetectPort *head)
Helper function used to print the list of ports present in this DetectPort list.
Definition: detect-engine-port.c:100
SCPortIntervalNode::IRB_ENTRY
IRB_ENTRY(SCPortIntervalNode) irb
SCPortIntervalNode
Definition: detect-engine-port.h:30
SCPortIntervalInsert
int SCPortIntervalInsert(DetectEngineCtx *, SCPortIntervalTree *, const DetectPort *)
Function to insert a node in the interval tree.
Definition: util-port-interval-tree.c:109
DetectPortCmp
int DetectPortCmp(DetectPort *, DetectPort *)
Function that compare port groups.
Definition: detect-engine-port.c:497
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectPortParse
int DetectPortParse(const DetectEngineCtx *, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1182
detect.h
DetectPort_
Port structure for detection engine.
Definition: detect.h:217
DetectPortListsAreEqual
bool DetectPortListsAreEqual(DetectPort *list1, DetectPort *list2)
Checks if two port group lists are equal.
Definition: detect-engine-port.c:638
SCPortIntervalTreeInit
SCPortIntervalTree * SCPortIntervalTreeInit(void)
Function to initialize the interval tree.
Definition: util-port-interval-tree.c:58
SCPortIntervalTree
struct SCPortIntervalTree_ SCPortIntervalTree
SCPortIntervalNode::port2
uint16_t port2
Definition: detect-engine-port.h:32
DetectPortCopySingle
DetectPort * DetectPortCopySingle(DetectEngineCtx *, DetectPort *)
Function that return a copy of DetectPort src sigs.
Definition: detect-engine-port.c:550
SCPortIntervalNode::port
uint16_t port
Definition: detect-engine-port.h:31
SCPortIntervalTree_::tree
struct PI tree
Definition: detect-engine-port.h:45
DetectPortHashAdd
int DetectPortHashAdd(DetectEngineCtx *de_ctx, DetectPort *dp)
Adds a DetectPort to the detection engine context DetectPort hash table.
Definition: detect-engine-port.c:1390
SCPortIntervalTreeFree
void SCPortIntervalTreeFree(DetectEngineCtx *, SCPortIntervalTree *)
Function to free an entire interval tree.
Definition: util-port-interval-tree.c:92
DetectPortHashLookup
DetectPort * DetectPortHashLookup(DetectEngineCtx *de_ctx, DetectPort *dp)
Used to lookup a DetectPort hash from the detection engine context DetectPort hash table.
Definition: detect-engine-port.c:1406
DetectPortInit
DetectPort * DetectPortInit(void)
Alloc a DetectPort structure and update counters.
Definition: detect-engine-port.c:67
DetectPortInsert
int DetectPortInsert(DetectEngineCtx *, DetectPort **, DetectPort *)
function for inserting a port group object. This also makes sure SigGroupContainer lists are handled ...
Definition: detect-engine-port.c:153
DetectPortFree
void DetectPortFree(const DetectEngineCtx *de_ctx, DetectPort *)
Free a DetectPort and its members.
Definition: detect-engine-port.c:80
SCPortIntervalTree_
Definition: detect-engine-port.h:44
str
#define str(s)
Definition: suricata-common.h:291
head
Flow * head
Definition: flow-hash.h:1
DetectPortHashFree
void DetectPortHashFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by DetectPortInit() function.
Definition: detect-engine-port.c:1421
interval-tree.h
DetectPortTests
void DetectPortTests(void)
DetectPortPrint
void DetectPortPrint(DetectPort *)
Helper function that print the DetectPort info.
Definition: detect-engine-port.c:590
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:124
SCPortIntervalTree_::head
SCPortIntervalNode * head
Definition: detect-engine-port.h:46
SCPortIntervalNode
struct SCPortIntervalNode SCPortIntervalNode
IRB_HEAD
IRB_HEAD(PI, SCPortIntervalNode)
DetectPortHashInit
int DetectPortHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table in the detection engine context to hold the DetectPort hash.
Definition: detect-engine-port.c:1370
SCPortIntervalFindOverlappingRanges
void SCPortIntervalFindOverlappingRanges(DetectEngineCtx *, const uint16_t, const uint16_t, const struct PI *, DetectPort **)
Callee function to find all overlapping port ranges as asked by the detection engine during Stage 2 o...
Definition: util-port-interval-tree.c:316