suricata
detect-engine-prefilter-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __DETECT_ENGINE_PREFILTER_COMMON_H__
19 #define __DETECT_ENGINE_PREFILTER_COMMON_H__
20 
21 typedef union {
22  uint8_t u8[8];
23  uint16_t u16[4];
24  uint32_t u32[2];
25  uint64_t u64;
27 
28 #define PREFILTER_EXTRA_MATCH_UNUSED 0
29 #define PREFILTER_EXTRA_MATCH_ALPROTO 1
30 #define PREFILTER_EXTRA_MATCH_SRCPORT 2
31 #define PREFILTER_EXTRA_MATCH_DSTPORT 3
32 
33 typedef struct PrefilterPacketHeaderCtx_ {
35 
36  uint16_t type;
37  uint16_t value;
38 
39  /** rules to add when the flags are present */
40  uint32_t sigs_cnt;
43 
44 typedef struct SigsArray_ {
46  uint32_t cnt;
47  uint32_t offset; // used to track assign pos
48 } SigsArray;
49 
50 typedef struct PrefilterPacketU8HashCtx_ {
51  SigsArray *array[256];
53 
54 #define PREFILTER_U8HASH_MODE_EQ 0
55 #define PREFILTER_U8HASH_MODE_LT 1
56 #define PREFILTER_U8HASH_MODE_GT 2
57 #define PREFILTER_U8HASH_MODE_RA 3
58 
60  SigGroupHead *sgh, int sm_type,
61  void (*Set)(PrefilterPacketHeaderValue *v, void *),
62  _Bool (*Compare)(PrefilterPacketHeaderValue v, void *),
63  void (*Match)(DetectEngineThreadCtx *det_ctx,
64  Packet *p, const void *pectx));
65 
67  SigGroupHead *sgh, int sm_type,
68  void (*Set)(PrefilterPacketHeaderValue *v, void *),
69  _Bool (*Compare)(PrefilterPacketHeaderValue v, void *),
70  void (*Match)(DetectEngineThreadCtx *det_ctx,
71  Packet *p, const void *pectx));
72 
73 static inline _Bool
74 PrefilterPacketHeaderExtraMatch(const PrefilterPacketHeaderCtx *ctx,
75  const Packet *p)
76 {
77  switch (ctx->type)
78  {
80  break;
82  if (p->flow == NULL || p->flow->alproto != ctx->value)
83  return FALSE;
84  break;
86  if (p->sp != ctx->value)
87  return FALSE;
88  break;
90  if (p->dp != ctx->value)
91  return FALSE;
92  break;
93  }
94  return TRUE;
95 }
96 
97 #endif /* __DETECT_ENGINE_PREFILTER_COMMON_H__ */
struct Flow_ * flow
Definition: decode.h:444
#define FALSE
Port sp
Definition: decode.h:414
struct PrefilterPacketU8HashCtx_ PrefilterPacketU8HashCtx
Port dp
Definition: decode.h:422
Container for matching data for a signature group.
Definition: detect.h:1295
struct SigsArray_ SigsArray
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), _Bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
#define TRUE
main detection engine ctx
Definition: detect.h:720
#define PREFILTER_EXTRA_MATCH_ALPROTO
#define PREFILTER_EXTRA_MATCH_UNUSED
struct PrefilterPacketHeaderCtx_ PrefilterPacketHeaderCtx
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), _Bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
#define PREFILTER_EXTRA_MATCH_DSTPORT
#define PREFILTER_EXTRA_MATCH_SRCPORT
AppProto alproto
application level protocol
Definition: flow.h:407
#define SigIntId