suricata
detect-engine-state.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup sigstate
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \brief Data structures and function prototypes for keeping
28  * state for the detection engine.
29  *
30  * \author Victor Julien <victor@inliniac.net>
31  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
32  */
33 
34 
35 #ifndef __DETECT_ENGINE_STATE_H__
36 #define __DETECT_ENGINE_STATE_H__
37 
38 #define DETECT_ENGINE_INSPECT_SIG_NO_MATCH 0
39 #define DETECT_ENGINE_INSPECT_SIG_MATCH 1
40 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH 2
41 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE 3
42 /** hack to work around a file inspection limitation. Since there can be
43  * multiple files in a TX and the detection engine really don't know
44  * about that, we have to give the file inspection engine a way to
45  * indicate that one of the files matched, but that there are still
46  * more files that have ongoing inspection. */
47 #define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES 4
48 
49 /** number of DeStateStoreItem's in one DeStateStore object */
50 #define DE_STATE_CHUNK_SIZE 15
51 
52 /* per sig flags */
53 #define DE_STATE_FLAG_FULL_INSPECT BIT_U32(0)
54 #define DE_STATE_FLAG_SIG_CANT_MATCH BIT_U32(1)
55 /* flag set if file inspecting sig did not match, but might need to be
56  * re-evaluated for a new file in a tx */
57 #define DE_STATE_ID_FILE_INSPECT 2UL
58 #define DE_STATE_FLAG_FILE_INSPECT BIT_U32(DE_STATE_ID_FILE_INSPECT)
59 
60 /* first bit position after the built-ins */
61 #define DE_STATE_FLAG_BASE 3UL
62 
63 /* state flags
64  *
65  * Used by app-layer-parsers to notify us that new files
66  * are available in the tx.
67  */
68 #define DETECT_ENGINE_STATE_FLAG_FILE_NEW BIT_U8(0)
69 
70 typedef struct DeStateStoreItem_ {
71  uint32_t flags;
74 
75 typedef struct DeStateStore_ {
78 } DeStateStore;
79 
84  uint16_t filestore_cnt;
85  uint8_t flags;
86  /* coccinelle: DetectEngineStateDirection:flags:DETECT_ENGINE_STATE_FLAG_ */
88 
89 typedef struct DetectEngineState_ {
92 
93 // TODO
94 typedef struct DetectTransaction_ {
95  void *tx_ptr;
96  const uint64_t tx_id;
98  const uint64_t detect_flags; /* detect flags get/set from/to applayer */
99  uint64_t prefilter_flags; /* prefilter flags for direction, to be updated by prefilter code */
100  const uint64_t prefilter_flags_orig; /* prefilter flags for direction, before prefilter has run */
101  const int tx_progress;
102  const int tx_end_state;
104 
105 /**
106  * \brief Alloc a DetectEngineState object.
107  *
108  * \retval Alloc'd instance of DetectEngineState.
109  */
111 
112 /**
113  * \brief Frees a DetectEngineState object.
114  *
115  * \param state DetectEngineState instance to free.
116  */
118 
119 /**
120  * \brief Update the inspect id.
121  *
122  * \param f unlocked flow
123  * \param flags direction and disruption flags
124  */
125 void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags,
126  const bool tag_txs_as_inspected);
127 
129 
130 void DeStateRegisterTests(void);
131 
132 
134  const SigGroupHead *sgh,
135  Flow *f, void *tx, uint64_t tx_id,
136  const Signature *s,
137  uint32_t inspect_flags, uint8_t flow_flags,
138  const uint16_t file_no_match);
139 
141  const SigGroupHead *sgh,
142  Flow *f, void *tx, uint64_t tx_id,
143  const uint8_t flow_flags,
144  const uint16_t file_no_match);
145 
146 #endif /* __DETECT_ENGINE_STATE_H__ */
147 
148 /**
149  * @}
150  */
DetectEngineStateDirection * de_state
Container for matching data for a signature group.
Definition: detect.h:1295
struct DeStateStore_ DeStateStore
Signature container.
Definition: detect.h:492
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
struct DeStateStore_ * next
const uint64_t prefilter_flags_orig
struct DeStateStoreItem_ DeStateStoreItem
void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags, const bool tag_txs_as_inspected)
Update the inspect id.
void DetectRunStoreStateTxFileOnly(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const uint8_t flow_flags, const uint16_t file_no_match)
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
DetectEngineState * DetectEngineStateAlloc(void)
Alloc a DetectEngineState object.
struct DetectTransaction_ DetectTransaction
const uint64_t detect_flags
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx&#39; To be used on detect engine reload.
uint16_t tx_id
void DeStateRegisterTests(void)
struct DetectEngineState_ DetectEngineState
struct DetectEngineStateDirection_ DetectEngineStateDirection
Flow data structure.
Definition: flow.h:327
#define SigIntId
#define DE_STATE_CHUNK_SIZE