suricata
detect-engine-state.h File Reference

Data structures and function prototypes for keeping state for the detection engine. More...

Go to the source code of this file.

Data Structures

struct  DeStateStoreItem_
 
struct  DeStateStore_
 
struct  DetectEngineStateDirection_
 
struct  DetectEngineState_
 
struct  DetectTransaction_
 
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH   0
 
#define DETECT_ENGINE_INSPECT_SIG_MATCH   1
 
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH   2
 
#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE   3
 
#define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES   4
 
#define DE_STATE_CHUNK_SIZE   15
 
#define DE_STATE_FLAG_FULL_INSPECT   BIT_U32(0)
 
#define DE_STATE_FLAG_SIG_CANT_MATCH   BIT_U32(1)
 
#define DE_STATE_ID_FILE_INSPECT   2UL
 
#define DE_STATE_FLAG_FILE_INSPECT   BIT_U32(DE_STATE_ID_FILE_INSPECT)
 
#define DE_STATE_FLAG_BASE   3UL
 
#define DETECT_ENGINE_STATE_FLAG_FILE_NEW   BIT_U8(0)
 
typedef struct DeStateStoreItem_ DeStateStoreItem
 
typedef struct DeStateStore_ DeStateStore
 
typedef struct DetectEngineStateDirection_ DetectEngineStateDirection
 
typedef struct DetectEngineState_ DetectEngineState
 
typedef struct DetectTransaction_ DetectTransaction
 
DetectEngineStateDetectEngineStateAlloc (void)
 Alloc a DetectEngineState object. More...
 
void DetectEngineStateFree (DetectEngineState *state)
 Frees a DetectEngineState object. More...
 
void DeStateUpdateInspectTransactionId (Flow *f, const uint8_t flags, const bool tag_txs_as_inspected)
 Update the inspect id. More...
 
void DetectEngineStateResetTxs (Flow *f)
 Reset de state for active tx' To be used on detect engine reload. More...
 
void DeStateRegisterTests (void)
 
void DetectRunStoreStateTx (const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
 
void DetectRunStoreStateTxFileOnly (const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const uint8_t flow_flags, const uint16_t file_no_match)
 

Detailed Description

Data structures and function prototypes for keeping state for the detection engine.

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t
Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Definition in file detect-engine-state.h.

Macro Definition Documentation

#define DE_STATE_CHUNK_SIZE   15

number of DeStateStoreItem's in one DeStateStore object

Definition at line 50 of file detect-engine-state.h.

#define DE_STATE_FLAG_BASE   3UL
#define DE_STATE_FLAG_FILE_INSPECT   BIT_U32(DE_STATE_ID_FILE_INSPECT)

Definition at line 58 of file detect-engine-state.h.

#define DE_STATE_FLAG_FULL_INSPECT   BIT_U32(0)

Definition at line 53 of file detect-engine-state.h.

#define DE_STATE_FLAG_SIG_CANT_MATCH   BIT_U32(1)

Definition at line 54 of file detect-engine-state.h.

#define DE_STATE_ID_FILE_INSPECT   2UL

Definition at line 57 of file detect-engine-state.h.

Referenced by DetectEngineAppInspectionEngine2Signature().

#define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE   3

Definition at line 41 of file detect-engine-state.h.

Referenced by DetectFileInspectGeneric().

#define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES   4

hack to work around a file inspection limitation. Since there can be multiple files in a TX and the detection engine really don't know about that, we have to give the file inspection engine a way to indicate that one of the files matched, but that there are still more files that have ongoing inspection.

Definition at line 47 of file detect-engine-state.h.

Referenced by DetectFileInspectGeneric().

#define DETECT_ENGINE_STATE_FLAG_FILE_NEW   BIT_U8(0)

Definition at line 68 of file detect-engine-state.h.

Typedef Documentation

typedef struct DeStateStore_ DeStateStore

Function Documentation

void DetectRunStoreStateTxFileOnly ( const SigGroupHead sgh,
Flow f,
void *  tx,
uint64_t  tx_id,
const uint8_t  flow_flags,
const uint16_t  file_no_match 
)