suricata
detect-engine-state.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup sigstate
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \brief Data structures and function prototypes for keeping
28  * state for the detection engine.
29  *
30  * \author Victor Julien <victor@inliniac.net>
31  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
32  */
33 
34 
35 #ifndef __DETECT_ENGINE_STATE_H__
36 #define __DETECT_ENGINE_STATE_H__
37 
38 #define DETECT_ENGINE_INSPECT_SIG_NO_MATCH 0
39 #define DETECT_ENGINE_INSPECT_SIG_MATCH 1
40 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH 2
41 /** indicate that the file inspection portion of a sig didn't match.
42  * This is used to handle state keeping as the detect engine is still
43  * only marginally aware of files. */
44 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILES 3
45 /** hack to work around a file inspection limitation. Since there can be
46  * multiple files in a TX and the detection engine really don't know
47  * about that, we have to give the file inspection engine a way to
48  * indicate that one of the files matched, but that there are still
49  * more files that have ongoing inspection. */
50 #define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES 4
51 
52 /** number of DeStateStoreItem's in one DeStateStore object */
53 #define DE_STATE_CHUNK_SIZE 15
54 
55 /* per sig flags */
56 #define DE_STATE_FLAG_FULL_INSPECT BIT_U32(0)
57 #define DE_STATE_FLAG_SIG_CANT_MATCH BIT_U32(1)
58 /* flag set if file inspecting sig did not match, but might need to be
59  * re-evaluated for a new file in a tx */
60 #define DE_STATE_ID_FILE_INSPECT 2UL
61 #define DE_STATE_FLAG_FILE_INSPECT BIT_U32(DE_STATE_ID_FILE_INSPECT)
62 
63 /* first bit position after the built-ins */
64 #define DE_STATE_FLAG_BASE 3UL
65 
66 /* state flags
67  *
68  * Used by app-layer-parsers to notify us that new files
69  * are available in the tx.
70  */
71 #define DETECT_ENGINE_STATE_FLAG_FILE_NEW BIT_U8(0)
72 
73 typedef struct DeStateStoreItem_ {
74  uint32_t flags;
77 
78 typedef struct DeStateStore_ {
82 
84  DeStateStore *head; /**< head of the list */
85  DeStateStore *cur; /**< current active store */
86  DeStateStore *tail; /**< tail of the list */
88  uint16_t filestore_cnt;
89  uint8_t flags;
90  /* coccinelle: DetectEngineStateDirection:flags:DETECT_ENGINE_STATE_FLAG_ */
92 
93 typedef struct DetectEngineState_ {
96 
97 // TODO
98 typedef struct DetectTransaction_ {
99  void *tx_ptr;
100  const uint64_t tx_id;
101  struct AppLayerTxData *tx_data_ptr;
103  const uint64_t detect_flags; /* detect flags get/set from/to applayer */
104  uint64_t prefilter_flags; /* prefilter flags for direction, to be updated by prefilter code */
105  const uint64_t prefilter_flags_orig; /* prefilter flags for direction, before prefilter has run */
106  const int tx_progress;
107  const int tx_end_state;
109 
110 /**
111  * \brief Alloc a DetectEngineState object.
112  *
113  * \retval Alloc'd instance of DetectEngineState.
114  */
116 
117 /**
118  * \brief Frees a DetectEngineState object.
119  *
120  * \param state DetectEngineState instance to free.
121  */
123 
124 /**
125  * \brief Update the inspect id.
126  *
127  * \param f unlocked flow
128  * \param flags direction and disruption flags
129  */
130 void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags,
131  const bool tag_txs_as_inspected);
132 
134 
135 void DeStateRegisterTests(void);
136 
137 
139  const SigGroupHead *sgh,
140  Flow *f, void *tx, uint64_t tx_id,
141  const Signature *s,
142  uint32_t inspect_flags, uint8_t flow_flags,
143  const uint16_t file_no_match);
144 
146  const SigGroupHead *sgh,
147  Flow *f, void *tx, uint64_t tx_id,
148  const uint8_t flow_flags,
149  const uint16_t file_no_match);
150 
151 #endif /* __DETECT_ENGINE_STATE_H__ */
152 
153 /**
154  * @}
155  */
DetectTransaction_::tx_data_ptr
struct AppLayerTxData * tx_data_ptr
Definition: detect-engine-state.h:101
DE_STATE_CHUNK_SIZE
#define DE_STATE_CHUNK_SIZE
Definition: detect-engine-state.h:53
DetectEngineStateDirection_::flags
uint8_t flags
Definition: detect-engine-state.h:89
DetectEngineState_
Definition: detect-engine-state.h:93
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1340
DetectEngineStateDirection_::cnt
SigIntId cnt
Definition: detect-engine-state.h:87
DetectEngineStateDirection
struct DetectEngineStateDirection_ DetectEngineStateDirection
Flow_
Flow data structure.
Definition: flow.h:350
DetectTransaction_::tx_end_state
const int tx_end_state
Definition: detect-engine-state.h:107
DetectEngineState
struct DetectEngineState_ DetectEngineState
DetectEngineState_::dir_state
DetectEngineStateDirection dir_state[2]
Definition: detect-engine-state.h:94
DeStateStoreItem_::sid
SigIntId sid
Definition: detect-engine-state.h:75
DetectTransaction_::tx_progress
const int tx_progress
Definition: detect-engine-state.h:106
DetectEngineStateDirection_::cur
DeStateStore * cur
Definition: detect-engine-state.h:85
DetectTransaction_::prefilter_flags_orig
const uint64_t prefilter_flags_orig
Definition: detect-engine-state.h:105
DetectTransaction
struct DetectTransaction_ DetectTransaction
DetectRunStoreStateTx
void DetectRunStoreStateTx(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
Definition: detect-engine-state.c:218
DeStateStoreItem_::flags
uint32_t flags
Definition: detect-engine-state.h:74
DeStateUpdateInspectTransactionId
void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags, const bool tag_txs_as_inspected)
Update the inspect id.
Definition: detect-engine-state.c:250
DeStateStore_::next
struct DeStateStore_ * next
Definition: detect-engine-state.h:80
DetectTransaction_::tx_id
const uint64_t tx_id
Definition: detect-engine-state.h:100
DetectEngineStateAlloc
DetectEngineState * DetectEngineStateAlloc(void)
Alloc a DetectEngineState object.
Definition: detect-engine-state.c:163
DetectRunStoreStateTxFileOnly
void DetectRunStoreStateTxFileOnly(const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const uint8_t flow_flags, const uint16_t file_no_match)
DetectTransaction_::prefilter_flags
uint64_t prefilter_flags
Definition: detect-engine-state.h:104
DetectTransaction_::de_state
DetectEngineStateDirection * de_state
Definition: detect-engine-state.h:102
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:173
DetectEngineStateDirection_::head
DeStateStore * head
Definition: detect-engine-state.h:84
DetectEngineStateResetTxs
void DetectEngineStateResetTxs(Flow *f)
Reset de state for active tx' To be used on detect engine reload.
Definition: detect-engine-state.c:282
flags
uint8_t flags
Definition: decode-gre.h:0
DeStateStore_
Definition: detect-engine-state.h:78
DetectTransaction_
Definition: detect-engine-state.h:98
DetectEngineStateDirection_
Definition: detect-engine-state.h:83
DeStateStore
struct DeStateStore_ DeStateStore
DetectTransaction_::tx_ptr
void * tx_ptr
Definition: detect-engine-state.h:99
DetectEngineStateDirection_::filestore_cnt
uint16_t filestore_cnt
Definition: detect-engine-state.h:88
DeStateStoreItem
struct DeStateStoreItem_ DeStateStoreItem
DeStateStore_::store
DeStateStoreItem store[DE_STATE_CHUNK_SIZE]
Definition: detect-engine-state.h:79
Signature_
Signature container.
Definition: detect.h:517
SigIntId
#define SigIntId
Definition: suricata-common.h:292
DeStateStoreItem_
Definition: detect-engine-state.h:73
DeStateRegisterTests
void DeStateRegisterTests(void)
Definition: detect-engine-state.c:1405
DetectEngineStateDirection_::tail
DeStateStore * tail
Definition: detect-engine-state.h:86
DetectTransaction_::detect_flags
const uint64_t detect_flags
Definition: detect-engine-state.h:103