suricata
detect-engine-prefilter-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __DETECT_ENGINE_PREFILTER_COMMON_H__
19 #define __DETECT_ENGINE_PREFILTER_COMMON_H__
20 
21 typedef union {
22  uint8_t u8[16];
23  uint16_t u16[8];
24  uint32_t u32[4];
25  uint64_t u64[2];
27 
28 #define PREFILTER_EXTRA_MATCH_UNUSED 0
29 #define PREFILTER_EXTRA_MATCH_ALPROTO 1
30 #define PREFILTER_EXTRA_MATCH_SRCPORT 2
31 #define PREFILTER_EXTRA_MATCH_DSTPORT 3
32 
33 typedef struct PrefilterPacketHeaderCtx_ {
35 
36  uint16_t type;
37  uint16_t value;
38 
39  /** rules to add when the flags are present */
40  uint32_t sigs_cnt;
43 
44 typedef struct SigsArray_ {
46  uint32_t cnt;
47  uint32_t offset; // used to track assign pos
48 } SigsArray;
49 
50 typedef struct PrefilterPacketU8HashCtx_ {
53 
54 #define PREFILTER_U8HASH_MODE_EQ 0
55 #define PREFILTER_U8HASH_MODE_LT 1
56 #define PREFILTER_U8HASH_MODE_GT 2
57 #define PREFILTER_U8HASH_MODE_RA 3
58 
60  SigGroupHead *sgh, int sm_type,
61  void (*Set)(PrefilterPacketHeaderValue *v, void *),
62  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
63  void (*Match)(DetectEngineThreadCtx *det_ctx,
64  Packet *p, const void *pectx));
65 
67  SigGroupHead *sgh, int sm_type,
68  void (*Set)(PrefilterPacketHeaderValue *v, void *),
69  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
70  void (*Match)(DetectEngineThreadCtx *det_ctx,
71  Packet *p, const void *pectx));
72 
73 static inline bool
74 PrefilterPacketHeaderExtraMatch(const PrefilterPacketHeaderCtx *ctx,
75  const Packet *p)
76 {
77  switch (ctx->type)
78  {
80  break;
82  if (p->flow == NULL || p->flow->alproto != ctx->value)
83  return FALSE;
84  break;
86  if (p->sp != ctx->value)
87  return FALSE;
88  break;
90  if (p->dp != ctx->value)
91  return FALSE;
92  break;
93  }
94  return TRUE;
95 }
96 
97 static inline bool PrefilterIsPrefilterableById(const Signature *s, enum DetectKeywordId kid)
98 {
99  const SigMatch *sm;
100  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
101  if (sm->type == kid) {
102  return true;
103  }
104  }
105  return false;
106 }
107 
108 #endif /* __DETECT_ENGINE_PREFILTER_COMMON_H__ */
PrefilterPacketHeaderCtx
struct PrefilterPacketHeaderCtx_ PrefilterPacketHeaderCtx
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1337
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:51
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:761
PrefilterPacketU8HashCtx
struct PrefilterPacketU8HashCtx_ PrefilterPacketU8HashCtx
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:41
DetectKeywordId
DetectKeywordId
Definition: detect-engine-register.h:27
PREFILTER_EXTRA_MATCH_SRCPORT
#define PREFILTER_EXTRA_MATCH_SRCPORT
Definition: detect-engine-prefilter-common.h:30
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:40
SigsArray_::offset
uint32_t offset
Definition: detect-engine-prefilter-common.h:47
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:33
PREFILTER_EXTRA_MATCH_DSTPORT
#define PREFILTER_EXTRA_MATCH_DSTPORT
Definition: detect-engine-prefilter-common.h:31
PrefilterPacketHeaderCtx_::value
uint16_t value
Definition: detect-engine-prefilter-common.h:37
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:16
DetectEngineThreadCtx_
Definition: detect.h:1004
PrefilterPacketHeaderCtx_::type
uint16_t type
Definition: detect-engine-prefilter-common.h:36
Packet_::sp
Port sp
Definition: decode.h:416
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:322
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
TRUE
#define TRUE
Definition: suricata-common.h:33
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
FALSE
#define FALSE
Definition: suricata-common.h:34
Packet_
Definition: decode.h:408
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:591
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:516
SigsArray
struct SigsArray_ SigsArray
SigMatch_::type
uint8_t type
Definition: detect.h:319
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:34
Packet_::flow
struct Flow_ * flow
Definition: decode.h:446
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:45
SigsArray_
Definition: detect-engine-prefilter-common.h:44
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:396
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:46
Signature_
Signature container.
Definition: detect.h:522
SigMatch_
a single match condition for a signature
Definition: detect.h:318
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:50
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:21
SigIntId
#define SigIntId
Definition: suricata-common.h:280
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
Packet_::dp
Port dp
Definition: decode.h:424
PREFILTER_EXTRA_MATCH_UNUSED
#define PREFILTER_EXTRA_MATCH_UNUSED
Definition: detect-engine-prefilter-common.h:28
PREFILTER_EXTRA_MATCH_ALPROTO
#define PREFILTER_EXTRA_MATCH_ALPROTO
Definition: detect-engine-prefilter-common.h:29