suricata
detect-engine-prefilter-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __DETECT_ENGINE_PREFILTER_COMMON_H__
19 #define __DETECT_ENGINE_PREFILTER_COMMON_H__
20 
21 #include "rust.h"
22 
23 typedef union {
24  uint8_t u8[16];
25  uint16_t u16[8];
26  uint32_t u32[4];
27  uint64_t u64[2];
29 
30 #define PREFILTER_EXTRA_MATCH_UNUSED 0
31 #define PREFILTER_EXTRA_MATCH_ALPROTO 1
32 #define PREFILTER_EXTRA_MATCH_SRCPORT 2
33 #define PREFILTER_EXTRA_MATCH_DSTPORT 3
34 
35 typedef struct PrefilterPacketHeaderCtx_ {
37 
38  uint16_t type;
39  uint16_t value;
40 
41  /** rules to add when the flags are present */
42  uint32_t sigs_cnt;
45 
46 typedef struct SigsArray_ {
48  uint32_t cnt;
49  uint32_t offset; // used to track assign pos
51 
52 typedef struct PrefilterPacketU8HashCtx_ {
55 
56 #define PREFILTER_U8HASH_MODE_EQ DetectUintModeEqual
57 #define PREFILTER_U8HASH_MODE_LT DetectUintModeLt
58 #define PREFILTER_U8HASH_MODE_GT DetectUintModeGt
59 #define PREFILTER_U8HASH_MODE_RA DetectUintModeRange
60 
62  SigGroupHead *sgh, int sm_type,
63  void (*Set)(PrefilterPacketHeaderValue *v, void *),
64  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
65  void (*Match)(DetectEngineThreadCtx *det_ctx,
66  Packet *p, const void *pectx));
67 
69  SigGroupHead *sgh, int sm_type,
70  void (*Set)(PrefilterPacketHeaderValue *v, void *),
71  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
72  void (*Match)(DetectEngineThreadCtx *det_ctx,
73  Packet *p, const void *pectx));
74 
75 static inline bool
76 PrefilterPacketHeaderExtraMatch(const PrefilterPacketHeaderCtx *ctx,
77  const Packet *p)
78 {
79  switch (ctx->type)
80  {
82  break;
84  if (p->flow == NULL || !AppProtoEquals(ctx->value, p->flow->alproto))
85  return false;
86  break;
88  if (p->sp != ctx->value)
89  return false;
90  break;
92  if (p->dp != ctx->value)
93  return false;
94  break;
95  }
96  return true;
97 }
98 
99 static inline bool PrefilterIsPrefilterableById(const Signature *s, enum DetectKeywordId kid)
100 {
101  const SigMatch *sm;
102  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
103  if (sm->type == kid) {
104  return true;
105  }
106  }
107  return false;
108 }
109 
110 #endif /* __DETECT_ENGINE_PREFILTER_COMMON_H__ */
PrefilterPacketHeaderCtx
struct PrefilterPacketHeaderCtx_ PrefilterPacketHeaderCtx
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1392
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:53
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:784
PrefilterPacketU8HashCtx
struct PrefilterPacketU8HashCtx_ PrefilterPacketU8HashCtx
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:43
rust.h
DetectKeywordId
DetectKeywordId
Definition: detect-engine-register.h:27
PREFILTER_EXTRA_MATCH_SRCPORT
#define PREFILTER_EXTRA_MATCH_SRCPORT
Definition: detect-engine-prefilter-common.h:32
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:42
SigsArray_::offset
uint32_t offset
Definition: detect-engine-prefilter-common.h:49
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
PREFILTER_EXTRA_MATCH_DSTPORT
#define PREFILTER_EXTRA_MATCH_DSTPORT
Definition: detect-engine-prefilter-common.h:33
PrefilterPacketHeaderCtx_::value
uint16_t value
Definition: detect-engine-prefilter-common.h:39
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1024
PrefilterPacketHeaderCtx_::type
uint16_t type
Definition: detect-engine-prefilter-common.h:38
Packet_::sp
Port sp
Definition: decode.h:435
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:317
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:78
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
Packet_
Definition: decode.h:428
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:610
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:533
SigsArray
struct SigsArray_ SigsArray
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:36
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:47
SigMatch_::type
uint16_t type
Definition: detect.h:314
SigsArray_
Definition: detect-engine-prefilter-common.h:46
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:48
Signature_
Signature container.
Definition: detect.h:539
SigMatch_
a single match condition for a signature
Definition: detect.h:313
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:52
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:23
SigIntId
#define SigIntId
Definition: suricata-common.h:304
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:463
Packet_::dp
Port dp
Definition: decode.h:443
PREFILTER_EXTRA_MATCH_UNUSED
#define PREFILTER_EXTRA_MATCH_UNUSED
Definition: detect-engine-prefilter-common.h:30
PREFILTER_EXTRA_MATCH_ALPROTO
#define PREFILTER_EXTRA_MATCH_ALPROTO
Definition: detect-engine-prefilter-common.h:31