suricata
detect-engine-state.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup sigstate
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \brief Data structures and function prototypes for keeping
28  * state for the detection engine.
29  *
30  * \author Victor Julien <victor@inliniac.net>
31  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
32  */
33 
34 #ifndef SURICATA_DETECT_ENGINE_STATE_H
35 #define SURICATA_DETECT_ENGINE_STATE_H
36 
37 // forward declaration for bindgen
38 #define SigIntId uint32_t
39 
40 #define DETECT_ENGINE_INSPECT_SIG_NO_MATCH 0
41 #define DETECT_ENGINE_INSPECT_SIG_MATCH 1
42 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH 2
43 /** indicate that the file inspection portion of a sig didn't match.
44  * This is used to handle state keeping as the detect engine is still
45  * only marginally aware of files. */
46 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES 3
47 /** hack to work around a file inspection limitation. Since there can be
48  * multiple files in a TX and the detection engine really don't know
49  * about that, we have to give the file inspection engine a way to
50  * indicate that one of the files matched, but that there are still
51  * more files that have ongoing inspection. */
52 #define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES 4
53 
54 /** number of DeStateStoreItem's in one DeStateStore object */
55 #define DE_STATE_CHUNK_SIZE 15
56 
57 /* per sig flags */
58 #define DE_STATE_FLAG_FULL_INSPECT BIT_U32(0)
59 #define DE_STATE_FLAG_SIG_CANT_MATCH BIT_U32(1)
60 /* flag set if file inspecting sig did not match, but might need to be
61  * re-evaluated for a new file in a tx */
62 #define DE_STATE_ID_FILE_INSPECT 2UL
63 #define DE_STATE_FLAG_FILE_INSPECT BIT_U32(DE_STATE_ID_FILE_INSPECT)
64 
65 /* first bit position after the built-ins */
66 #define DE_STATE_FLAG_BASE 3UL
67 
68 /* state flags
69  *
70  * Used by app-layer-parsers to notify us that new files
71  * are available in the tx.
72  */
73 #define DETECT_ENGINE_STATE_FLAG_FILE_NEW BIT_U8(0)
74 
75 typedef struct DeStateStoreItem_ {
76  uint32_t flags;
79 
80 typedef struct DeStateStore_ {
84 
86  DeStateStore *head; /**< head of the list */
87  DeStateStore *cur; /**< current active store */
88  DeStateStore *tail; /**< tail of the list */
90  uint16_t filestore_cnt;
91  uint8_t flags;
92  /* coccinelle: DetectEngineStateDirection:flags:DETECT_ENGINE_STATE_FLAG_ */
94 
95 typedef struct DetectEngineState_ {
98 
99 /**
100  * \brief Alloc a DetectEngineState object.
101  *
102  * \retval Alloc'd instance of DetectEngineState.
103  */
105 
106 /**
107  * \brief Frees a DetectEngineState object.
108  *
109  * \param state DetectEngineState instance to free.
110  */
112 
113 #endif /* SURICATA_DETECT_ENGINE_STATE_H */
114 
115 /**
116  * @}
117  */
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:55
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:91
DetectEngineState_
Definition: detect-engine-state.h:95
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:89
DetectEngineStateDirection
struct DetectEngineStateDirection_ DetectEngineStateDirection
DetectEngineState
struct DetectEngineState_ DetectEngineState
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:96
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:77
DetectEngineStateDirection_::cur
DeStateStore * cur
Definition: detect-engine-state.h:87
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:76
SCDetectEngineStateFree
void SCDetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:169
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:82
DetectEngineStateAlloc
DetectEngineState * DetectEngineStateAlloc(void)
Alloc a DetectEngineState object.
Definition: detect-engine-state.c:160
SigIntId
#define SigIntId
Definition: detect-engine-state.h:38
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:86
DeStateStore_
Definition: detect-engine-state.h:80
DetectEngineStateDirection_
Definition: detect-engine-state.h:85
DeStateStore
struct DeStateStore_ DeStateStore
DetectEngineStateDirection_::filestore_cnt
uint16_t filestore_cnt
Definition: detect-engine-state.h:90
DeStateStoreItem
struct DeStateStoreItem_ DeStateStoreItem
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:81
DeStateStoreItem_
Definition: detect-engine-state.h:75
DetectEngineStateDirection_::tail
DeStateStore * tail
Definition: detect-engine-state.h:88