suricata
detect-engine-siggroup.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "flow-var.h"
#include "app-layer-protos.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-build.h"
#include "detect-engine-address.h"
#include "detect-engine-mpm.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-prefilter.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-tcp-flags.h"
#include "util-hash.h"
#include "util-hashlist.h"
#include "util-error.h"
#include "util-debug.h"
#include "util-cidr.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-memcmp.h"
Include dependency graph for detect-engine-siggroup.c:

Go to the source code of this file.

Functions

int SigGroupHeadClearSigs (SigGroupHead *sgh)
 Clears the bitarray holding the sids for this SigGroupHead. More...
 
void SigGroupHeadInitDataFree (SigGroupHeadInitData *sghid)
 
void SigGroupHeadStore (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
void SigGroupHeadFree (const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Free a SigGroupHead and its members. More...
 
int SigGroupHeadHashInit (DetectEngineCtx *de_ctx)
 Initializes the hash table in the detection engine context to hold the SigGroupHeads. More...
 
int SigGroupHeadHashAdd (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Adds a SigGroupHead to the detection engine context SigGroupHead hash table. More...
 
int SigGroupHeadHashRemove (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 
SigGroupHeadSigGroupHeadHashLookup (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table. More...
 
void SigGroupHeadHashFree (DetectEngineCtx *de_ctx)
 Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function. More...
 
int SigGroupHeadAppendSig (const DetectEngineCtx *de_ctx, SigGroupHead **sgh, const Signature *s)
 Add a Signature to a SigGroupHead. More...
 
int SigGroupHeadCopySigs (DetectEngineCtx *de_ctx, SigGroupHead *src, SigGroupHead **dst)
 Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead. More...
 
void SigGroupHeadSetSigCnt (SigGroupHead *sgh, uint32_t max_idx)
 Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead. More...
 
void SigGroupHeadSetProtoAndDirection (SigGroupHead *sgh, uint8_t ipproto, int dir)
 
void SigGroupHeadPrintSigs (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Helper function used to print the list of sids for the Signatures present in this SigGroupHead. More...
 
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx)
 Create an array with all the internal ids of the sigs that this sig group head will check for. More...
 
void SigGroupHeadSetFilemagicFlag (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Set the need magic flag in the sgh. More...
 
void SigGroupHeadSetFilesizeFlag (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Set the need size flag in the sgh. More...
 
void SigGroupHeadSetFileHashFlag (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Set the need hash flag in the sgh. More...
 
void SigGroupHeadSetFilestoreCount (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Set the filestore_cnt in the sgh. More...
 
int SigGroupHeadBuildNonPrefilterArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 build an array of rule id's for sigs with no prefilter Also updated de_ctx::non_pf_store_cnt_max to track the highest cnt More...
 
int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid)
 Check if a SigGroupHead contains a Signature, whose sid is sent as an argument. More...
 
int SigAddressPrepareStage1 (DetectEngineCtx *)
 Preprocess signature, classify ip-only, etc, build sig array. More...
 
void SigGroupHeadRegisterTests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Signature grouping part of the detection engine.

Definition in file detect-engine-siggroup.c.

Function Documentation

◆ SigAddressPrepareStage1()

int SigAddressPrepareStage1 ( DetectEngineCtx de_ctx)

Preprocess signature, classify ip-only, etc, build sig array.

Parameters
de_ctxPointer to the Detection Engine Context
Return values
0on success
-1on failure

Definition at line 1372 of file detect-engine-build.c.

References de_ctx, DE_QUIET, DetectEngineGetMaxSigId, DetectEngineCtx_::flags, Signature_::id, Signature_::next, Signature_::num, SCLogDebug, SCMalloc, DetectEngineCtx_::sig_array, DetectEngineCtx_::sig_array_len, DetectEngineCtx_::sig_array_size, DetectEngineCtx_::sig_list, SIG_TYPE_IPONLY, SIG_TYPE_PDONLY, and Signature_::type.

◆ SigGroupHeadAppendSig()

int SigGroupHeadAppendSig ( const DetectEngineCtx de_ctx,
SigGroupHead **  sgh,
const Signature s 
)

Add a Signature to a SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to a SigGroupHead. Can be NULL also.
sPointer to the Signature that has to be added to the SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 340 of file detect-engine-siggroup.c.

References de_ctx.

◆ SigGroupHeadBuildMatchArray()

int SigGroupHeadBuildMatchArray ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  max_idx 
)

Create an array with all the internal ids of the sigs that this sig group head will check for.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
max_idxThe maximum value of the sid in the SigGroupHead arg.
Return values
0success
-1error

Definition at line 489 of file detect-engine-siggroup.c.

References BUG_ON, de_ctx, SigGroupHead_::init, SigGroupHeadInitData_::match_array, SCMalloc, DetectEngineCtx_::sig_array, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_cnt.

◆ SigGroupHeadBuildNonPrefilterArray()

◆ SigGroupHeadClearSigs()

int SigGroupHeadClearSigs ( SigGroupHead sgh)

Clears the bitarray holding the sids for this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
Return values
0Always.

Definition at line 369 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::sig_array, SigGroupHeadInitData_::sig_cnt, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadContainsSigId()

int SigGroupHeadContainsSigId ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  sid 
)

Check if a SigGroupHead contains a Signature, whose sid is sent as an argument.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead that has to be checked for the presence of a Signature.
sidThe Signature id(sid) that has to be checked in the SigGroupHead.
Return values
1On successfully finding the sid in the SigGroupHead.
0If the sid is not found in the SigGroupHead

Definition at line 737 of file detect-engine-siggroup.c.

References de_ctx, DetectEngineGetMaxSigId, Signature_::id, SigGroupHead_::init, SCEnter, SCReturnInt, DetectEngineCtx_::sig_array, and SigGroupHeadInitData_::sig_array.

◆ SigGroupHeadCopySigs()

int SigGroupHeadCopySigs ( DetectEngineCtx de_ctx,
SigGroupHead src,
SigGroupHead **  dst 
)

Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
srcPointer to the source SigGroupHead.
dstPointer to the destination SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 393 of file detect-engine-siggroup.c.

References de_ctx, dst, and src.

Referenced by DetectPortInsert().

Here is the caller graph for this function:

◆ SigGroupHeadFree()

void SigGroupHeadFree ( const DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Free a SigGroupHead and its members.

Parameters
sghPointer to the SigGroupHead that has to be freed.

Definition at line 163 of file detect-engine-siggroup.c.

References de_ctx, SigGroupHead_::init, SigGroupHead_::non_pf_other_store_array, SigGroupHead_::non_pf_other_store_cnt, SigGroupHead_::non_pf_syn_store_array, SigGroupHead_::non_pf_syn_store_cnt, PrefilterCleanupRuleGroup(), SCFree, SCLogDebug, and SigGroupHeadInitDataFree().

Referenced by DetectPortFree(), and SigAddressCleanupStage1().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupHeadHashAdd()

int SigGroupHeadHashAdd ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Adds a SigGroupHead to the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
ret0 on Successfully adding the SigGroupHead; -1 on failure.

Definition at line 280 of file detect-engine-siggroup.c.

References de_ctx, HashListTableAdd(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadHashFree()

void SigGroupHeadHashFree ( DetectEngineCtx de_ctx)

Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function.

Parameters
de_ctxPointer to the detection engine context.

Definition at line 318 of file detect-engine-siggroup.c.

References de_ctx, HashListTableFree(), and DetectEngineCtx_::sgh_hash_table.

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupHeadHashInit()

int SigGroupHeadHashInit ( DetectEngineCtx de_ctx)

Initializes the hash table in the detection engine context to hold the SigGroupHeads.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 258 of file detect-engine-siggroup.c.

References de_ctx, HashListTableInit(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadHashLookup()

SigGroupHead* SigGroupHeadHashLookup ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
rsghOn success a pointer to the SigGroupHead if the SigGroupHead is found in the hash table; NULL on failure.

Definition at line 302 of file detect-engine-siggroup.c.

References de_ctx, HashListTableLookup(), SCEnter, SCReturnPtr, and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadHashRemove()

int SigGroupHeadHashRemove ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Definition at line 287 of file detect-engine-siggroup.c.

References de_ctx, HashListTableRemove(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadInitDataFree()

◆ SigGroupHeadPrintSigs()

void SigGroupHeadPrintSigs ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Helper function used to print the list of sids for the Signatures present in this SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.

Definition at line 457 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SCEnter, SCLogDebug, SCReturn, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadRegisterTests()

void SigGroupHeadRegisterTests ( void  )

Definition at line 1108 of file detect-engine-siggroup.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ SigGroupHeadSetFileHashFlag()

void SigGroupHeadSetFileHashFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need hash flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 585 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::init, SigGroupHeadInitData_::match_array, SCLogDebug, SigGroupHeadInitData_::sig_cnt, SIG_GROUP_HEAD_HAVEFILEMD5, SIG_GROUP_HEAD_HAVEFILESHA1, SIG_GROUP_HEAD_HAVEFILESHA256, SignatureIsFileMd5Inspecting(), SignatureIsFileSha1Inspecting(), and SignatureIsFileSha256Inspecting().

Here is the call graph for this function:

◆ SigGroupHeadSetFilemagicFlag()

void SigGroupHeadSetFilemagicFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need magic flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 528 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::init, SigGroupHeadInitData_::match_array, SigGroupHeadInitData_::sig_cnt, and SignatureIsFilemagicInspecting().

Here is the call graph for this function:

◆ SigGroupHeadSetFilesizeFlag()

void SigGroupHeadSetFilesizeFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need size flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 557 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::init, SigGroupHeadInitData_::match_array, SigGroupHeadInitData_::sig_cnt, SIG_GROUP_HEAD_HAVEFILESIZE, and SignatureIsFilesizeInspecting().

Here is the call graph for this function:

◆ SigGroupHeadSetFilestoreCount()

void SigGroupHeadSetFilestoreCount ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the filestore_cnt in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the counter in

Definition at line 626 of file detect-engine-siggroup.c.

References SigGroupHead_::filestore_cnt, SigGroupHead_::init, SigGroupHeadInitData_::match_array, SigGroupHeadInitData_::sig_cnt, and SignatureIsFilestoring().

Here is the call graph for this function:

◆ SigGroupHeadSetProtoAndDirection()

void SigGroupHeadSetProtoAndDirection ( SigGroupHead sgh,
uint8_t  ipproto,
int  dir 
)

◆ SigGroupHeadSetSigCnt()

void SigGroupHeadSetSigCnt ( SigGroupHead sgh,
uint32_t  max_idx 
)

Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
max_idxMaximum sid of the all the Signatures present in this SigGroupHead.

Definition at line 427 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_cnt.

◆ SigGroupHeadStore()