suricata
detect-engine-siggroup.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

int SigGroupHeadAppendSig (const DetectEngineCtx *, SigGroupHead **, const Signature *)
 Add a Signature to a SigGroupHead. More...
 
int SigGroupHeadClearSigs (SigGroupHead *)
 Clears the bitarray holding the sids for this SigGroupHead. More...
 
int SigGroupHeadCopySigs (DetectEngineCtx *, SigGroupHead *, SigGroupHead **)
 Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead. More...
 
void SigGroupHeadFree (const DetectEngineCtx *de_ctx, SigGroupHead *)
 Free a SigGroupHead and its members. More...
 
SigGroupHeadSigGroupHeadHashLookup (DetectEngineCtx *, SigGroupHead *)
 Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table. More...
 
int SigGroupHeadHashAdd (DetectEngineCtx *, SigGroupHead *)
 Adds a SigGroupHead to the detection engine context SigGroupHead hash table. More...
 
void SigGroupHeadHashFree (DetectEngineCtx *)
 Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function. More...
 
int SigGroupHeadHashInit (DetectEngineCtx *)
 Initializes the hash table in the detection engine context to hold the SigGroupHeads. More...
 
void SigGroupHeadInitDataFree (SigGroupHeadInitData *sghid)
 
void SigGroupHeadSetSigCnt (SigGroupHead *sgh, uint32_t max_idx)
 Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead. More...
 
bool SigGroupHeadEqual (const SigGroupHead *, const SigGroupHead *)
 Finds if two Signature Group Heads are the same. More...
 
void SigGroupHeadSetProtoAndDirection (SigGroupHead *sgh, uint8_t ipproto, int dir)
 
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx)
 Create an array with all the internal ids of the sigs that this sig group head will check for. More...
 
int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid)
 Check if a SigGroupHead contains a Signature, whose sid is sent as an argument. More...
 
void SigGroupHeadRegisterTests (void)
 
void SigGroupHeadPrintSigs (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Helper function used to print the list of sids for the Signatures present in this SigGroupHead. More...
 
void SigGroupHeadStore (DetectEngineCtx *, SigGroupHead *)
 
void SigGroupHeadSetupFiles (const DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Set the need hash flag in the sgh. More...
 
int SigGroupHeadBuildNonPrefilterArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 build an array of rule id's for sigs with no prefilter Also updated de_ctx::non_pf_store_cnt_max to track the highest cnt More...
 

Detailed Description

Function Documentation

◆ SigGroupHeadAppendSig()

int SigGroupHeadAppendSig ( const DetectEngineCtx de_ctx,
SigGroupHead **  sgh,
const Signature s 
)

Add a Signature to a SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to a SigGroupHead. Can be NULL also.
sPointer to the Signature that has to be added to the SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 330 of file detect-engine-siggroup.c.

References de_ctx.

◆ SigGroupHeadBuildMatchArray()

int SigGroupHeadBuildMatchArray ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  max_idx 
)

Create an array with all the internal ids of the sigs that this sig group head will check for.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
max_idxThe maximum value of the sid in the SigGroupHead arg.
Return values
0success
-1error

Definition at line 546 of file detect-engine-siggroup.c.

References BUG_ON, de_ctx, SigGroupHead_::init, SigGroupHeadInitData_::match_array, MAX, SigGroupHeadInitData_::max_sig_id, SCCalloc, DetectEngineCtx_::sig_array, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_cnt.

◆ SigGroupHeadBuildNonPrefilterArray()

◆ SigGroupHeadClearSigs()

int SigGroupHeadClearSigs ( SigGroupHead sgh)

Clears the bitarray holding the sids for this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
Return values
0Always.

Definition at line 359 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::sig_array, SigGroupHeadInitData_::sig_cnt, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadContainsSigId()

int SigGroupHeadContainsSigId ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  sid 
)

Check if a SigGroupHead contains a Signature, whose sid is sent as an argument.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead that has to be checked for the presence of a Signature.
sidThe Signature id(sid) that has to be checked in the SigGroupHead.
Return values
1On successfully finding the sid in the SigGroupHead.
0If the sid is not found in the SigGroupHead

Definition at line 710 of file detect-engine-siggroup.c.

References de_ctx, DetectEngineGetMaxSigId, Signature_::id, SigGroupHead_::init, SCEnter, SCReturnInt, DetectEngineCtx_::sig_array, and SigGroupHeadInitData_::sig_array.

◆ SigGroupHeadCopySigs()

int SigGroupHeadCopySigs ( DetectEngineCtx de_ctx,
SigGroupHead src,
SigGroupHead **  dst 
)

Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
srcPointer to the source SigGroupHead.
dstPointer to the destination SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 401 of file detect-engine-siggroup.c.

References de_ctx, dst, and src.

Referenced by DetectPortCopySingle(), and SCPortIntervalInsert().

Here is the caller graph for this function:

◆ SigGroupHeadEqual()

bool SigGroupHeadEqual ( const SigGroupHead sgha,
const SigGroupHead sghb 
)

Finds if two Signature Group Heads are the same.

Parameters
sghaFirst SGH to be compared
sghbSecornd SGH to be compared
Returns
true if they're a match, false otherwise

Definition at line 480 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::max_sig_id, SCMemcmp, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadFree()

void SigGroupHeadFree ( const DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Free a SigGroupHead and its members.

Parameters
sghPointer to the SigGroupHead that has to be freed.

Definition at line 162 of file detect-engine-siggroup.c.

References de_ctx, SigGroupHead_::init, SigGroupHead_::non_pf_other_store_array, SigGroupHead_::non_pf_other_store_cnt, SigGroupHead_::non_pf_syn_store_array, SigGroupHead_::non_pf_syn_store_cnt, PrefilterCleanupRuleGroup(), SCFree, SCLogDebug, and SigGroupHeadInitDataFree().

Referenced by DetectPortFree(), and SigAddressCleanupStage1().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupHeadHashAdd()

int SigGroupHeadHashAdd ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Adds a SigGroupHead to the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
ret0 on Successfully adding the SigGroupHead; -1 on failure.

Definition at line 277 of file detect-engine-siggroup.c.

References de_ctx, HashListTableAdd(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadHashFree()

void SigGroupHeadHashFree ( DetectEngineCtx de_ctx)

Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function.

Parameters
de_ctxPointer to the detection engine context.

Definition at line 310 of file detect-engine-siggroup.c.

References de_ctx, HashListTableFree(), and DetectEngineCtx_::sgh_hash_table.

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SigGroupHeadHashInit()

int SigGroupHeadHashInit ( DetectEngineCtx de_ctx)

Initializes the hash table in the detection engine context to hold the SigGroupHeads.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 255 of file detect-engine-siggroup.c.

References de_ctx, HashListTableInit(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadHashLookup()

SigGroupHead* SigGroupHeadHashLookup ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
rsghOn success a pointer to the SigGroupHead if the SigGroupHead is found in the hash table; NULL on failure.

Definition at line 294 of file detect-engine-siggroup.c.

References de_ctx, HashListTableLookup(), SCEnter, SCReturnPtr, and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

◆ SigGroupHeadInitDataFree()

◆ SigGroupHeadPrintSigs()

void SigGroupHeadPrintSigs ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Helper function used to print the list of sids for the Signatures present in this SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.

Definition at line 514 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SCEnter, SCLogDebug, SCReturn, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadRegisterTests()

void SigGroupHeadRegisterTests ( void  )

Definition at line 1082 of file detect-engine-siggroup.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ SigGroupHeadSetProtoAndDirection()

void SigGroupHeadSetProtoAndDirection ( SigGroupHead sgh,
uint8_t  ipproto,
int  dir 
)

◆ SigGroupHeadSetSigCnt()

void SigGroupHeadSetSigCnt ( SigGroupHead sgh,
uint32_t  max_idx 
)

Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
max_idxMaximum sid of the all the Signatures present in this SigGroupHead.

Definition at line 457 of file detect-engine-siggroup.c.

References cnt, SigGroupHead_::init, MAX, SigGroupHeadInitData_::max_sig_id, SigGroupHeadInitData_::sig_array, SigGroupHeadInitData_::sig_cnt, and SigGroupHeadInitData_::sig_size.

◆ SigGroupHeadSetupFiles()

void SigGroupHeadSetupFiles ( const DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

◆ SigGroupHeadStore()