suricata
detect-engine-siggroup.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

int SigGroupHeadAppendSig (const DetectEngineCtx *, SigGroupHead **, const Signature *)
 Add a Signature to a SigGroupHead. More...
 
int SigGroupHeadClearSigs (SigGroupHead *)
 Clears the bitarray holding the sids for this SigGroupHead. More...
 
int SigGroupHeadCopySigs (DetectEngineCtx *, SigGroupHead *, SigGroupHead **)
 Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead. More...
 
void SigGroupHeadFree (const DetectEngineCtx *de_ctx, SigGroupHead *)
 Free a SigGroupHead and its members. More...
 
void SigGroupHeadFreeMpmArrays (DetectEngineCtx *)
 
SigGroupHeadSigGroupHeadHashLookup (DetectEngineCtx *, SigGroupHead *)
 Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table. More...
 
SigGroupHeadSigGroupHeadMpmHashLookup (DetectEngineCtx *, SigGroupHead *)
 
SigGroupHeadSigGroupHeadDPortHashLookup (DetectEngineCtx *, SigGroupHead *)
 
int SigGroupHeadMpmHashAdd (DetectEngineCtx *, SigGroupHead *)
 
int SigGroupHeadHashAdd (DetectEngineCtx *, SigGroupHead *)
 Adds a SigGroupHead to the detection engine context SigGroupHead hash table. More...
 
int SigGroupHeadDPortHashAdd (DetectEngineCtx *, SigGroupHead *)
 
void SigGroupHeadHashFree (DetectEngineCtx *)
 Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function. More...
 
void SigGroupHeadMpmHashFree (DetectEngineCtx *)
 
void SigGroupHeadDPortHashFree (DetectEngineCtx *)
 
int SigGroupHeadHashInit (DetectEngineCtx *)
 Initializes the hash table in the detection engine context to hold the SigGroupHeads. More...
 
int SigGroupHeadMpmHashInit (DetectEngineCtx *)
 
int SigGroupHeadDPortHashInit (DetectEngineCtx *)
 
int SigGroupHeadHashRemove (DetectEngineCtx *, SigGroupHead *)
 
void SigGroupHeadInitDataFree (SigGroupHeadInitData *sghid)
 
void SigGroupHeadSetSigCnt (SigGroupHead *sgh, uint32_t max_idx)
 Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead. More...
 
void SigGroupHeadSetProtoAndDirection (SigGroupHead *sgh, uint8_t ipproto, int dir)
 
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx)
 Create an array with all the internal ids of the sigs that this sig group head will check for. More...
 
void SigGroupHeadFreeSigArrays (DetectEngineCtx *de_ctx)
 
int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid)
 Check if a SigGroupHead contains a Signature, whose sid is sent as an argument. More...
 
void SigGroupHeadRegisterTests (void)
 
void SigGroupHeadPrintSigs (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 Helper function used to print the list of sids for the Signatures present in this SigGroupHead. More...
 
void SigGroupHeadStore (DetectEngineCtx *, SigGroupHead *)
 
void SigGroupHeadSetFilemagicFlag (DetectEngineCtx *, SigGroupHead *)
 Set the need magic flag in the sgh. More...
 
void SigGroupHeadSetFilestoreCount (DetectEngineCtx *, SigGroupHead *)
 Set the filestore_cnt in the sgh. More...
 
void SigGroupHeadSetFileHashFlag (DetectEngineCtx *, SigGroupHead *)
 Set the need hash flag in the sgh. More...
 
void SigGroupHeadSetFilesizeFlag (DetectEngineCtx *, SigGroupHead *)
 Set the need size flag in the sgh. More...
 
uint16_t SigGroupHeadGetMinMpmSize (DetectEngineCtx *de_ctx, SigGroupHead *sgh, int list)
 
int SigGroupHeadBuildNonPrefilterArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 build an array of rule id's for sigs with no prefilter Also updated de_ctx::non_pf_store_cnt_max to track the highest cnt More...
 

Detailed Description

Function Documentation

int SigGroupHeadAppendSig ( const DetectEngineCtx de_ctx,
SigGroupHead **  sgh,
const Signature s 
)

Add a Signature to a SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to a SigGroupHead. Can be NULL also.
sPointer to the Signature that has to be added to the SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 338 of file detect-engine-siggroup.c.

References DetectEngineGetMaxSigId, and Signature_::num.

Referenced by CreateGroupedPortList(), DetectPortHashFree(), PacketCreateMask(), and SigGroupHeadContainsSigId().

Here is the caller graph for this function:

int SigGroupHeadBuildMatchArray ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  max_idx 
)

Create an array with all the internal ids of the sigs that this sig group head will check for.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
max_idxThe maximum value of the sid in the SigGroupHead arg.
Return values
0success
-1error

Definition at line 487 of file detect-engine-siggroup.c.

References BUG_ON, SigGroupHead_::init, SigGroupHead_::match_array, SCMalloc, DetectEngineCtx_::sig_array, SigGroupHeadInitData_::sig_array, and SigGroupHead_::sig_cnt.

Referenced by PacketCreateMask(), SigAddressPrepareStage2(), and SigGroupHeadContainsSigId().

Here is the caller graph for this function:

int SigGroupHeadClearSigs ( SigGroupHead sgh)

Clears the bitarray holding the sids for this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
Return values
0Always.

Definition at line 367 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::sig_array, SigGroupHead_::sig_cnt, and SigGroupHeadInitData_::sig_size.

Referenced by DetectPortInsert(), and SigGroupHeadContainsSigId().

Here is the caller graph for this function:

int SigGroupHeadContainsSigId ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
uint32_t  sid 
)

Check if a SigGroupHead contains a Signature, whose sid is sent as an argument.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead that has to be checked for the presence of a Signature.
sidThe Signature id(sid) that has to be checked in the SigGroupHead.
Return values
1On successfully finding the sid in the SigGroupHead.
0If the sid is not found in the SigGroupHead

Definition at line 735 of file detect-engine-siggroup.c.

References AddressDebugPrint(), DetectEngineAppendSig(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineGetMaxSigId, DetectEngineThreadCtxInit(), Packet_::dst, Packet_::icmpv4h, Signature_::id, SigGroupHead_::init, SigGroupHead_::match_array, Signature_::next, SCEnter, SCReturnInt, DetectEngineCtx_::sgh_hash_table, DetectEngineCtx_::sig_array, SigGroupHeadInitData_::sig_array, SigGroupHead_::sig_cnt, DetectEngineCtx_::sig_list, SigAddressPrepareStage1(), SigCleanSignatures(), SigGroupBuild(), SigGroupHeadAppendSig(), SigGroupHeadBuildMatchArray(), SigGroupHeadClearSigs(), SigGroupHeadContainsSigId(), SigGroupHeadCopySigs(), SigGroupHeadFree(), SigGroupHeadHashFree(), SigGroupHeadHashInit(), SigGroupHeadSetSigCnt(), SigInit(), SigMatchSignaturesGetSgh(), UTHBuildPacketSrcDst(), and UTHFreePackets().

Referenced by SigGroupHeadContainsSigId().

Here is the call graph for this function:

Here is the caller graph for this function:

int SigGroupHeadCopySigs ( DetectEngineCtx de_ctx,
SigGroupHead src,
SigGroupHead **  dst 
)

Copies the bitarray holding the sids from the source SigGroupHead to the destination SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
srcPointer to the source SigGroupHead.
dstPointer to the destination SigGroupHead.
Return values
0On success.
-1On failure.

Definition at line 391 of file detect-engine-siggroup.c.

References DetectEngineGetMaxSigId, SigGroupHead_::init, MAX, SigGroupHeadInitData_::sig_array, SigGroupHeadInitData_::sig_size, and SigGroupHeadInitData_::whitelist.

Referenced by CreateGroupedPortList(), DetectPortCopySingle(), DetectPortInsert(), DetectPortJoin(), and SigGroupHeadContainsSigId().

Here is the caller graph for this function:

int SigGroupHeadDPortHashAdd ( DetectEngineCtx ,
SigGroupHead  
)
void SigGroupHeadDPortHashFree ( DetectEngineCtx )
int SigGroupHeadDPortHashInit ( DetectEngineCtx )
SigGroupHead* SigGroupHeadDPortHashLookup ( DetectEngineCtx ,
SigGroupHead  
)
void SigGroupHeadFreeMpmArrays ( DetectEngineCtx )
void SigGroupHeadFreeSigArrays ( DetectEngineCtx de_ctx)
uint16_t SigGroupHeadGetMinMpmSize ( DetectEngineCtx de_ctx,
SigGroupHead sgh,
int  list 
)
int SigGroupHeadHashAdd ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Adds a SigGroupHead to the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
ret0 on Successfully adding the SigGroupHead; -1 on failure.

Definition at line 278 of file detect-engine-siggroup.c.

References HashListTableAdd(), and DetectEngineCtx_::sgh_hash_table.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

void SigGroupHeadHashFree ( DetectEngineCtx de_ctx)

Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by SigGroupHeadHashInit() function.

Parameters
de_ctxPointer to the detection engine context.

Definition at line 316 of file detect-engine-siggroup.c.

References HashListTableFree(), and DetectEngineCtx_::sgh_hash_table.

Referenced by DetectEngineCtxFree(), PacketCreateMask(), SigAddressPrepareStage4(), and SigGroupHeadContainsSigId().

Here is the call graph for this function:

Here is the caller graph for this function:

int SigGroupHeadHashInit ( DetectEngineCtx de_ctx)

Initializes the hash table in the detection engine context to hold the SigGroupHeads.

Parameters
de_ctxPointer to the detection engine context.
Return values
0On success.
-1On failure.

Definition at line 256 of file detect-engine-siggroup.c.

References HashListTableInit(), and DetectEngineCtx_::sgh_hash_table.

Referenced by DetectEngineInspectPktBufferGeneric(), PacketCreateMask(), and SigGroupHeadContainsSigId().

Here is the call graph for this function:

Here is the caller graph for this function:

SigGroupHead* SigGroupHeadHashLookup ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Used to lookup a SigGroupHead hash from the detection engine context SigGroupHead hash table.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.
Return values
rsghOn success a pointer to the SigGroupHead if the SigGroupHead is found in the hash table; NULL on failure.

Definition at line 300 of file detect-engine-siggroup.c.

References HashListTableLookup(), SCEnter, SCReturnPtr, and DetectEngineCtx_::sgh_hash_table.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function:

int SigGroupHeadHashRemove ( DetectEngineCtx ,
SigGroupHead  
)

Definition at line 285 of file detect-engine-siggroup.c.

References HashListTableRemove(), and DetectEngineCtx_::sgh_hash_table.

Here is the call graph for this function:

int SigGroupHeadMpmHashAdd ( DetectEngineCtx ,
SigGroupHead  
)
void SigGroupHeadMpmHashFree ( DetectEngineCtx )
int SigGroupHeadMpmHashInit ( DetectEngineCtx )
SigGroupHead* SigGroupHeadMpmHashLookup ( DetectEngineCtx ,
SigGroupHead  
)
void SigGroupHeadPrintSigs ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Helper function used to print the list of sids for the Signatures present in this SigGroupHead.

Parameters
de_ctxPointer to the detection engine context.
sghPointer to the SigGroupHead.

Definition at line 455 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SCEnter, SCLogDebug, SCReturn, SigGroupHeadInitData_::sig_array, and SigGroupHeadInitData_::sig_size.

void SigGroupHeadRegisterTests ( void  )

Definition at line 1205 of file detect-engine-siggroup.c.

References UtRegisterTest().

Here is the call graph for this function:

void SigGroupHeadSetFileHashFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need hash flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 583 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::match_array, SCLogDebug, SigGroupHead_::sig_cnt, SIG_GROUP_HEAD_HAVEFILEMD5, SIG_GROUP_HEAD_HAVEFILESHA1, SIG_GROUP_HEAD_HAVEFILESHA256, SignatureIsFileMd5Inspecting(), SignatureIsFileSha1Inspecting(), and SignatureIsFileSha256Inspecting().

Referenced by SigAddressPrepareStage4().

Here is the call graph for this function:

Here is the caller graph for this function:

void SigGroupHeadSetFilemagicFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need magic flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 526 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::match_array, SigGroupHead_::sig_cnt, and SignatureIsFilemagicInspecting().

Referenced by SigAddressPrepareStage4().

Here is the call graph for this function:

Here is the caller graph for this function:

void SigGroupHeadSetFilesizeFlag ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the need size flag in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the flag in

Definition at line 555 of file detect-engine-siggroup.c.

References SigGroupHead_::flags, SigGroupHead_::match_array, SigGroupHead_::sig_cnt, SIG_GROUP_HEAD_HAVEFILESIZE, and SignatureIsFilesizeInspecting().

Referenced by SigAddressPrepareStage4().

Here is the call graph for this function:

Here is the caller graph for this function:

void SigGroupHeadSetFilestoreCount ( DetectEngineCtx de_ctx,
SigGroupHead sgh 
)

Set the filestore_cnt in the sgh.

Parameters
de_ctxdetection engine ctx for the signatures
sghsig group head to set the counter in

Definition at line 624 of file detect-engine-siggroup.c.

References SigGroupHead_::filestore_cnt, SigGroupHead_::match_array, SigGroupHead_::sig_cnt, and SignatureIsFilestoring().

Referenced by SigAddressPrepareStage4().

Here is the call graph for this function:

Here is the caller graph for this function:

void SigGroupHeadSetProtoAndDirection ( SigGroupHead sgh,
uint8_t  ipproto,
int  dir 
)

Definition at line 438 of file detect-engine-siggroup.c.

References SigGroupHeadInitData_::direction, SigGroupHead_::init, SigGroupHeadInitData_::protos, and SCLogDebug.

Referenced by PacketCreateMask().

Here is the caller graph for this function:

void SigGroupHeadSetSigCnt ( SigGroupHead sgh,
uint32_t  max_idx 
)

Updates the SigGroupHead->sig_cnt with the total count of all the Signatures present in this SigGroupHead.

Parameters
sghPointer to the SigGroupHead.
max_idxMaximum sid of the all the Signatures present in this SigGroupHead.

Definition at line 425 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SigGroupHeadInitData_::sig_array, and SigGroupHead_::sig_cnt.

Referenced by CreateGroupedPortList(), PacketCreateMask(), SigAddressPrepareStage2(), and SigGroupHeadContainsSigId().

Here is the caller graph for this function:

void SigGroupHeadStore ( DetectEngineCtx ,
SigGroupHead  
)

Definition at line 99 of file detect-engine-siggroup.c.

References SigGroupHead_::init, SCFree, SCMalloc, SCRealloc, DetectEngineCtx_::sgh_array, DetectEngineCtx_::sgh_array_cnt, DetectEngineCtx_::sgh_array_size, SigGroupHeadFree(), and unlikely.

Referenced by PacketCreateMask().

Here is the call graph for this function:

Here is the caller graph for this function: