suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "flow-private.h"
#include "flow-util.h"
#include "flow-worker.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "datasets.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-tag.h"
#include "detect-engine-file.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
#include "detect-byte-extract.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-tcphdr.h"
#include "detect-engine-threshold.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-loader.h"
#include "util-classification-config.h"
#include "util-reference-config.h"
#include "util-threshold-config.h"
#include "util-error.h"
#include "util-hash.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-action.h"
#include "util-magic.h"
#include "util-signal.h"
#include "util-spm.h"
#include "util-device.h"
#include "util-var-name.h"
#include "util-profiling.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "reputation.h"
#include "util-hash-lookup3.h"
Go to the source code of this file.
Data Structures | |
struct | DetectEngineSyncer_ |
struct | TenantLoaderCtx_ |
Macros | |
#define | DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000 |
Typedefs | |
typedef struct DetectEngineSyncer_ | DetectEngineSyncer |
typedef struct TenantLoaderCtx_ | TenantLoaderCtx |
Enumerations | |
enum | DetectEngineSyncState { IDLE, RELOAD } |
Variables | |
SCEnumCharMap | det_ctx_event_table [] |
Definition in file detect-engine.c.
#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000 |
Definition at line 86 of file detect-engine.c.
typedef struct DetectEngineSyncer_ DetectEngineSyncer |
typedef struct TenantLoaderCtx_ TenantLoaderCtx |
Enumerator | |
---|---|
IDLE | ready to start a reload |
RELOAD | command main thread to do the reload |
Definition at line 1474 of file detect-engine.c.
void DetectAppLayerInspectEngineRegister2 | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectEngineFuncPtr2 | Callback2, | ||
InspectionBufferGetDataPtr | GetData | ||
) |
register inspect engine at start up time
Registers an app inspection engine.
Definition at line 172 of file detect-engine.c.
int DetectBufferGetActiveList | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 950 of file detect-engine.c.
References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_NOTSET, DetectBufferTypeGetByIdTransforms(), Signature_::init_data, SignatureInitData_::list, SignatureInitData_::list_set, SC_ERR_INVALID_SIGNATURE, SCLogDebug, SCLogError, SCReturnInt, DetectEngineTransforms::transforms, and SignatureInitData_::transforms.
Referenced by DetectContentSetup().
void DetectBufferRunSetupCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
Signature * | s | ||
) |
Definition at line 908 of file detect-engine.c.
bool DetectBufferRunValidateCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
const Signature * | s, | ||
const char ** | sigerror | ||
) |
Definition at line 927 of file detect-engine.c.
int DetectBufferSetActiveList | ( | Signature * | s, |
const int | list | ||
) |
Definition at line 937 of file detect-engine.c.
void DetectBufferTypeCloseRegistration | ( | void | ) |
Definition at line 1248 of file detect-engine.c.
References BUG_ON.
Referenced by SigTableSetup().
int DetectBufferTypeGetByIdTransforms | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
TransformData * | transforms, | ||
int | transform_cnt | ||
) |
Definition at line 1255 of file detect-engine.c.
Referenced by DetectBufferGetActiveList().
int DetectBufferTypeGetByName | ( | const char * | name | ) |
Definition at line 825 of file detect-engine.c.
Referenced by DetectEngineAppInspectionEngine2Signature(), and DetectPktInspectEngineRegister().
const char* DetectBufferTypeGetDescriptionById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 862 of file detect-engine.c.
const char* DetectBufferTypeGetDescriptionByName | ( | const char * | name | ) |
Definition at line 871 of file detect-engine.c.
const char* DetectBufferTypeGetNameById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 834 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_map, DetectEngineCtx_::buffer_type_map_elements, BUG_ON, de_ctx, and DetectBufferType_::string.
Referenced by DetectEngineAppInspectionEngine2Signature(), EngineAnalysisRules2(), and SignatureIsIPOnly().
int DetectBufferTypeMaxId | ( | void | ) |
Definition at line 684 of file detect-engine.c.
Referenced by SigAlloc().
int DetectBufferTypeRegister | ( | const char * | name | ) |
Definition at line 781 of file detect-engine.c.
References BUG_ON.
Referenced by DetectPktInspectEngineRegister().
void DetectBufferTypeRegisterSetupCallback | ( | const char * | name, |
void(*)(const DetectEngineCtx *, Signature *) | SetupCallback | ||
) |
Definition at line 898 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeRegisterValidateCallback | ( | const char * | name, |
bool(*)(const Signature *, const char **sigerror) | ValidateCallback | ||
) |
Definition at line 917 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSetDescriptionByName | ( | const char * | name, |
const char * | desc | ||
) |
Definition at line 853 of file detect-engine.c.
void DetectBufferTypeSupportsMpm | ( | const char * | name | ) |
Definition at line 805 of file detect-engine.c.
References BUG_ON.
bool DetectBufferTypeSupportsMpmGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 889 of file detect-engine.c.
Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().
void DetectBufferTypeSupportsPacket | ( | const char * | name | ) |
Definition at line 795 of file detect-engine.c.
References BUG_ON.
bool DetectBufferTypeSupportsPacketGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 880 of file detect-engine.c.
void DetectBufferTypeSupportsTransformations | ( | const char * | name | ) |
Definition at line 815 of file detect-engine.c.
References BUG_ON.
bool DetectBufferTypeValidateTransform | ( | DetectEngineCtx * | de_ctx, |
int | sm_list, | ||
const uint8_t * | content, | ||
uint16_t | content_len, | ||
const char ** | namestr | ||
) |
Check content byte array compatibility with transforms.
The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.
When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first positive validation result terminates the loop.
de_ctx | Detection engine context. |
sm_list | The SM list id. |
content | The byte array being validated |
namestr | returns the name of the transform that is incompatible with content. |
true | (false) If any of the transforms indicate the byte array is (is not) compatible. |
Definition at line 1134 of file detect-engine.c.
Referenced by DetectContentSetup().
int DetectEngineAddToMaster | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 3904 of file detect-engine.c.
References de_ctx, and SCLogDebug.
int DetectEngineAppInspectionEngine2Signature | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 411 of file detect-engine.c.
References DetectEngineAppInspectionEngine_::alproto, Signature_::alproto, ALPROTO_UNKNOWN, DetectEngineCtx_::app_inspect_engines, DetectEnginePktInspectionEngine::Callback, de_ctx, DE_STATE_FLAG_BASE, DETECT_SM_LIST_DYNAMIC_START, DetectBufferTypeGetByName(), DetectBufferTypeGetNameById(), DetectEnginePktInspectionEngine::GetData, Signature_::init_data, DetectEnginePktInspectionEngine::mpm, SignatureInitData_::mpm_sm, next, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, DetectEngineCtx_::pkt_inspect_engines, SCCalloc, SCLogDebug, SigMatchList2DataArray(), SigMatchListSMBelongsTo(), DetectEngineAppInspectionEngine_::sm_list, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, DetectEnginePktInspectionEngine::smd, SignatureInitData_::smlists, SignatureInitData_::smlists_array_size, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.
void DetectEngineAppInspectionEngineSignatureFree | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
free app inspect engines for a signature
For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.
Definition at line 613 of file detect-engine.c.
References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, SigTableElmt_::Free, SigMatchData_::is_last, MAX, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::sm_list, DetectEnginePktInspectionEngine::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, and SigMatchData_::type.
void DetectEngineBumpVersion | ( | void | ) |
Definition at line 3170 of file detect-engine.c.
void DetectEngineCtxFree | ( | DetectEngineCtx * | de_ctx | ) |
Free a DetectEngineCtx::
de_ctx | DetectEngineCtx:: to be freed |
Definition at line 2040 of file detect-engine.c.
References de_ctx, DetectParseDupSigHashFree(), MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_ctx, DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingRuleDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::spm_global_thread_ctx, SpmDestroyGlobalThreadCtx(), and ThresholdContextDestroy().
Referenced by UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().
DetectEngineCtx* DetectEngineCtxInit | ( | void | ) |
Definition at line 1995 of file detect-engine.c.
Referenced by DetectEngineCtxInitWithPrefix(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().
DetectEngineCtx* DetectEngineCtxInitStubForDD | ( | void | ) |
Definition at line 1990 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitStubForMT | ( | void | ) |
Definition at line 1985 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitWithPrefix | ( | const char * | prefix | ) |
Definition at line 2000 of file detect-engine.c.
References DetectEngineCtxInit().
void DetectEngineDeReference | ( | DetectEngineCtx ** | de_ctx | ) |
Definition at line 3880 of file detect-engine.c.
int DetectEngineEnabled | ( | void | ) |
Check if detection is enabled.
bool | true or false |
Definition at line 3146 of file detect-engine.c.
DetectEngineCtx* DetectEngineGetByTenantId | ( | int | tenant_id | ) |
Definition at line 3854 of file detect-engine.c.
DetectEngineCtx* DetectEngineGetCurrent | ( | void | ) |
Definition at line 3179 of file detect-engine.c.
Referenced by DetectEngineThreadCtxInit().
int DetectEngineGetEventInfo | ( | const char * | event_name, |
int * | event_id, | ||
AppLayerEventType * | event_type | ||
) |
Definition at line 4224 of file detect-engine.c.
References APP_LAYER_EVENT_TYPE_TRANSACTION, det_ctx_event_table, SC_ERR_INVALID_ENUM_MAP, SCLogError, and SCMapEnumNameToValue().
AppLayerDecoderEvents* DetectEngineGetEvents | ( | DetectEngineThreadCtx * | det_ctx | ) |
Definition at line 4219 of file detect-engine.c.
References DetectEngineThreadCtx_::decoder_events.
uint32_t DetectEngineGetVersion | ( | void | ) |
Definition at line 3160 of file detect-engine.c.
References version.
int DetectEngineInspectBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match. |
1 | match. |
2 | Sig can't match. |
Definition at line 1588 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), DetectEngineThreadCtx_::buffer_offset, de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.
int DetectEngineInspectGenericList | ( | const DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
const SigMatchData * | smd, | ||
Flow * | f, | ||
const uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
sm | SigMatch to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match |
1 | match |
Definition at line 1546 of file detect-engine.c.
References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, and SigMatchData_::type.
Referenced by DetectEngineInspectDnsRequest(), and DetectEngineInspectDnsResponse().
int DetectEngineInspectPktBufferGeneric | ( | DetectEngineThreadCtx * | det_ctx, |
const DetectEnginePktInspectionEngine * | engine, | ||
const Signature * | s, | ||
Packet * | p, | ||
uint8_t * | _alert_flags | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
p | Packet |
0 | no match. |
1 | match. |
Definition at line 1653 of file detect-engine.c.
References DetectEngineThreadCtx_::buffer_offset, DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEnginePktInspectionEngine::mpm, offset, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectEngineLoadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml | ||
) |
Load a tenant and wait for loading to complete.
Definition at line 3405 of file detect-engine.c.
int DetectEngineMoveToFreeList | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 3920 of file detect-engine.c.
int DetectEngineMTApply | ( | void | ) |
Definition at line 4114 of file detect-engine.c.
int DetectEngineMultiTenantEnabled | ( | void | ) |
TODO locking? Not needed if this is a one time setting at startup
Definition at line 3211 of file detect-engine.c.
int DetectEngineMultiTenantSetup | ( | void | ) |
setup multi-detect / multi-tenancy
See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.
Definition at line 3554 of file detect-engine.c.
References TENANT_SELECTOR_UNKNOWN.
int DetectEngineMustParseMetadata | ( | void | ) |
Definition at line 4179 of file detect-engine.c.
Referenced by DetectMetadataHashInit().
bool DetectEnginePktInspectionRun | ( | ThreadVars * | tv, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p, | ||
uint8_t * | alert_flags | ||
) |
Definition at line 1405 of file detect-engine.c.
References Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, and SCLogDebug.
int DetectEnginePktInspectionSetup | ( | Signature * | s | ) |
Definition at line 1452 of file detect-engine.c.
References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.
void DetectEnginePruneFreeList | ( | void | ) |
Definition at line 3971 of file detect-engine.c.
DetectEngineCtx* DetectEngineReference | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 3202 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::ref_cnt.
void DetectEngineRegisterTests | ( | ) |
Definition at line 4480 of file detect-engine.c.
References UtRegisterTest().
int DetectEngineReload | ( | const SCInstance * | suri | ) |
Reload the detection engine.
filename | YAML file to load for the detect config |
-1 | error |
0 | ok |
Definition at line 4010 of file detect-engine.c.
References SCInstance_::conf_filename, and SCLogNotice.
int DetectEngineReloadIsIdle | ( | void | ) |
Definition at line 1522 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadIsStart | ( | void | ) |
Definition at line 1502 of file detect-engine.c.
References SCMutexLock.
void DetectEngineReloadSetIdle | ( | void | ) |
Definition at line 1514 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadStart | ( | void | ) |
Definition at line 1488 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml, | ||
int | reload_cnt | ||
) |
Reload a tenant and wait for loading to complete.
Definition at line 3419 of file detect-engine.c.
void DetectEngineResetMaxSigId | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 2421 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::signum.
Referenced by SigCleanSignatures().
void DetectEngineSetEvent | ( | DetectEngineThreadCtx * | det_ctx, |
uint8_t | e | ||
) |
Definition at line 4213 of file detect-engine.c.
References AppLayerDecoderEventsSetEventRaw(), DetectEngineThreadCtx_::decoder_events, and DetectEngineThreadCtx_::events.
Referenced by FileSwfDecompression(), FileSwfLzmaDecompression(), and FileSwfZlibDecompression().
void DetectEngineSetParseMetadata | ( | void | ) |
Definition at line 4169 of file detect-engine.c.
int DetectEngineTentantRegisterLivedev | ( | uint32_t | tenant_id, |
int | device_id | ||
) |
Definition at line 3822 of file detect-engine.c.
int DetectEngineTentantRegisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 3837 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTentantRegisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 3827 of file detect-engine.c.
int DetectEngineTentantUnregisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 3843 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTentantUnregisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 3832 of file detect-engine.c.
TmEcode DetectEngineThreadCtxDeinit | ( | ThreadVars * | tv, |
void * | data | ||
) |
Definition at line 2952 of file detect-engine.c.
References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SC_ERR_INVALID_ARGUMENTS, SCLogWarning, and TM_ECODE_OK.
Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
void DetectEngineThreadCtxInfo | ( | ThreadVars * | t, |
DetectEngineThreadCtx * | det_ctx | ||
) |
Definition at line 2970 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DetectEngineCtx_::mpm_matcher, DetectEngineThreadCtx_::mtc, DetectEngineThreadCtx_::mtcu, and PatternMatchThreadPrint().
TmEcode DetectEngineThreadCtxInit | ( | ThreadVars * | tv, |
void * | initdata, | ||
void ** | data | ||
) |
initialize thread specific detection engine context
tv | ThreadVars for this thread |
initdata | pointer to de_ctx |
data[out] | pointer to store our thread detection ctx |
TM_ECODE_OK | if all went well |
TM_ECODE_FAILED | on serious errors |
alert counter setup
Definition at line 2744 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCMalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
void DetectEngineUnsetParseMetadata | ( | void | ) |
Definition at line 4174 of file detect-engine.c.
void DetectPktInspectEngineRegister | ( | const char * | name, |
InspectionBufferGetPktDataPtr | GetPktData, | ||
InspectionBufferPktInspectFunc | Callback | ||
) |
register inspect engine at start up time
Definition at line 129 of file detect-engine.c.
References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, SC_ERR_INITIALIZATION, SC_ERR_INVALID_ARGUMENTS, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectRegisterThreadCtxFuncs | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc, | ||
int | mode | ||
) |
Register Thread keyword context Funcs.
de_ctx | detection engine to register in |
name | keyword name for error printing |
InitFunc | function ptr |
data | keyword init data to pass to Func. Can be NULL. |
FreeFunc | function ptr |
mode | 0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct) |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 2993 of file detect-engine.c.
References BUG_ON, DetectEngineThreadKeywordCtxItem_::data, de_ctx, DetectEngineThreadKeywordCtxItem_::FreeFunc, DetectEngineThreadKeywordCtxItem_::id, DetectEngineThreadKeywordCtxItem_::InitFunc, DetectEngineCtx_::keyword_id, DetectEngineCtx_::keyword_list, DetectEngineThreadKeywordCtxItem_::name, DetectEngineThreadKeywordCtxItem_::next, SCMalloc, and unlikely.
int DetectRegisterThreadCtxGlobalFuncs | ( | const char * | name, |
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc | ||
) |
Register Thread keyword context Funcs (Global)
IDs stay static over reloads and between tenants
name | keyword name for error printing |
InitFunc | function ptr |
FreeFunc | function ptr |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 3090 of file detect-engine.c.
References BUG_ON.
const char* DetectSigmatchListEnumToString | ( | enum DetectSigmatchListEnum | type | ) |
Definition at line 4184 of file detect-engine.c.
References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.
void* DetectThreadCtxGetGlobalKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3134 of file detect-engine.c.
References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.
Referenced by HttpHeaderGetBufferSpaceForTXID().
void* DetectThreadCtxGetKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3070 of file detect-engine.c.
References DetectEngineThreadCtx_::keyword_ctxs_array, and DetectEngineThreadCtx_::keyword_ctxs_size.
int DetectUnregisterThreadCtxFuncs | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
void * | data, | ||
const char * | name | ||
) |
Remove Thread keyword context registration.
de_ctx | detection engine to deregister from |
det_ctx | detection engine thread context to deregister from |
data | keyword init data to pass to Func. Can be NULL. |
name | keyword name for error printing |
1 | Item unregistered |
0 | otherwise |
Definition at line 3039 of file detect-engine.c.
References BUG_ON, DetectEngineThreadKeywordCtxItem_::data, de_ctx, DetectEngineThreadKeywordCtxItem_::FreeFunc, DetectEngineThreadKeywordCtxItem_::id, DetectEngineThreadCtx_::keyword_ctxs_array, DetectEngineCtx_::keyword_list, DetectEngineThreadKeywordCtxItem_::name, DetectEngineThreadKeywordCtxItem_::next, and SCFree.
void InspectionBufferApplyTransforms | ( | InspectionBuffer * | buffer, |
const DetectEngineTransforms * | transforms | ||
) |
Definition at line 1159 of file detect-engine.c.
References BUG_ON, DETECT_TRANSFORMS_MAX, TransformData_::options, SCLogDebug, sigmatch_table, TransformData_::transform, SigTableElmt_::Transform, and DetectEngineTransforms::transforms.
void InspectionBufferCheckAndExpand | ( | InspectionBuffer * | buffer, |
uint32_t | min_size | ||
) |
make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary
Definition at line 1087 of file detect-engine.c.
References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.
Referenced by FileSwfDecompression(), and InspectionBufferCopy().
void InspectionBufferClean | ( | DetectEngineThreadCtx * | det_ctx | ) |
Definition at line 980 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
void InspectionBufferCopy | ( | InspectionBuffer * | buffer, |
uint8_t * | buf, | ||
uint32_t | buf_len | ||
) |
Definition at line 1104 of file detect-engine.c.
References InspectionBuffer::buf, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.
void InspectionBufferFree | ( | InspectionBuffer * | buffer | ) |
Definition at line 1075 of file detect-engine.c.
References InspectionBuffer::buf, and SCFree.
InspectionBuffer* InspectionBufferGet | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id | ||
) |
Definition at line 1006 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, and DetectEngineThreadCtx_::inspect.
InspectionBufferMultipleForList* InspectionBufferGetMulti | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id | ||
) |
Definition at line 1041 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
void InspectionBufferInit | ( | InspectionBuffer * | buffer, |
uint32_t | initial_size | ||
) |
Definition at line 1051 of file detect-engine.c.
References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.
InspectionBuffer* InspectionBufferMultipleForListGet | ( | InspectionBufferMultipleForList * | fb, |
uint32_t | local_id | ||
) |
for a InspectionBufferMultipleForList get a InspectionBuffer
fb | the multiple buffer array |
local_id | the index to get a buffer |
buffer | the inspect buffer or NULL in case of error |
Definition at line 1015 of file detect-engine.c.
References InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, MAX, SCLogDebug, SCRealloc, and InspectionBufferMultipleForList::size.
void InspectionBufferSetup | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id, | ||
InspectionBuffer * | buffer, | ||
const uint8_t * | data, | ||
const uint32_t | data_len | ||
) |
setup the buffer with our initial data
Definition at line 1061 of file detect-engine.c.
References InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBuffer::inspect_len, InspectionBuffer::len, InspectionBuffer::orig, InspectionBuffer::orig_len, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
SCEnumCharMap det_ctx_event_table[] |
Definition at line 105 of file detect-engine.c.
Referenced by DetectEngineGetEventInfo().