suricata
detect-engine.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "detect.h"
#include "flow.h"
#include "flow-private.h"
#include "flow-util.h"
#include "flow-worker.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "datasets.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-tag.h"
#include "detect-engine-frame.h"
#include "detect-engine-file.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
#include "detect-fast-pattern.h"
#include "detect-byte-extract.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-tcphdr.h"
#include "detect-engine-threshold.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-loader.h"
#include "util-classification-config.h"
#include "util-reference-config.h"
#include "util-threshold-config.h"
#include "util-error.h"
#include "util-hash.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-action.h"
#include "util-magic.h"
#include "util-signal.h"
#include "util-spm.h"
#include "util-device.h"
#include "util-var-name.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-hash-string.h"
#include "util-enum.h"
#include "util-conf.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "reputation.h"
#include "util-hash-lookup3.h"

Go to the source code of this file.

Data Structures

struct  DetectEngineSyncer_
 
struct  TenantLoaderCtx_
 

Macros

#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT   3000
 

Typedefs

typedef struct DetectEngineSyncer_ DetectEngineSyncer
 
typedef struct TenantLoaderCtx_ TenantLoaderCtx
 

Enumerations

enum  DetectEngineSyncState { IDLE, RELOAD }
 

Functions

void DetectPktInspectEngineRegister (const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
 register inspect engine at start up time More...
 
void DetectFrameInspectEngineRegister (const char *name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
 register inspect engine at start up time More...
 
void DetectAppLayerInspectEngineRegister2 (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr2 Callback2, InspectionBufferGetDataPtr GetData)
 register inspect engine at start up time More...
 
void DetectEngineFrameInspectEngineRegister (DetectEngineCtx *de_ctx, const char *name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
 register inspect engine at start up time More...
 
int DetectEngineAppInspectionEngine2Signature (DetectEngineCtx *de_ctx, Signature *s)
 
void DetectEngineAppInspectionEngineSignatureFree (DetectEngineCtx *de_ctx, Signature *s)
 free app inspect engines for a signature More...
 
int DetectBufferTypeMaxId (void)
 
int DetectBufferTypeRegister (const char *name)
 
void DetectBufferTypeSupportsFrames (const char *name)
 
void DetectBufferTypeSupportsPacket (const char *name)
 
void DetectBufferTypeSupportsMpm (const char *name)
 
void DetectBufferTypeSupportsTransformations (const char *name)
 
int DetectBufferTypeGetByName (const char *name)
 
const DetectBufferTypeDetectEngineBufferTypeGetById (const DetectEngineCtx *de_ctx, const int id)
 
const char * DetectEngineBufferTypeGetNameById (const DetectEngineCtx *de_ctx, const int id)
 
int DetectEngineBufferTypeRegisterWithFrameEngines (DetectEngineCtx *de_ctx, const char *name, const int direction, const AppProto alproto, const uint8_t frame_type)
 
int DetectEngineBufferTypeRegister (DetectEngineCtx *de_ctx, const char *name)
 
void DetectBufferTypeSetDescriptionByName (const char *name, const char *desc)
 
const char * DetectEngineBufferTypeGetDescriptionById (const DetectEngineCtx *de_ctx, const int id)
 
const char * DetectBufferTypeGetDescriptionByName (const char *name)
 
void DetectEngineBufferTypeSupportsFrames (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsPacket (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsMpm (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsTransformations (DetectEngineCtx *de_ctx, const char *name)
 
bool DetectEngineBufferTypeSupportsPacketGetById (const DetectEngineCtx *de_ctx, const int id)
 
bool DetectEngineBufferTypeSupportsMpmGetById (const DetectEngineCtx *de_ctx, const int id)
 
void DetectBufferTypeRegisterSetupCallback (const char *name, void(*SetupCallback)(const DetectEngineCtx *, Signature *))
 
void DetectEngineBufferRunSetupCallback (const DetectEngineCtx *de_ctx, const int id, Signature *s)
 
void DetectBufferTypeRegisterValidateCallback (const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror))
 
bool DetectEngineBufferRunValidateCallback (const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
 
int DetectBufferSetActiveList (Signature *s, const int list)
 
int DetectBufferGetActiveList (DetectEngineCtx *de_ctx, Signature *s)
 
void InspectionBufferClean (DetectEngineThreadCtx *det_ctx)
 
InspectionBufferInspectionBufferGet (DetectEngineThreadCtx *det_ctx, const int list_id)
 
InspectionBufferInspectionBufferMultipleForListGet (DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
 for a InspectionBufferMultipleForList get a InspectionBuffer More...
 
void InspectionBufferInit (InspectionBuffer *buffer, uint32_t initial_size)
 
void InspectionBufferSetupMulti (InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
 setup the buffer with our initial data More...
 
void InspectionBufferSetup (DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
 setup the buffer with our initial data More...
 
void InspectionBufferFree (InspectionBuffer *buffer)
 
void InspectionBufferCheckAndExpand (InspectionBuffer *buffer, uint32_t min_size)
 make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary More...
 
void InspectionBufferCopy (InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
 
bool DetectEngineBufferTypeValidateTransform (DetectEngineCtx *de_ctx, int sm_list, const uint8_t *content, uint16_t content_len, const char **namestr)
 Check content byte array compatibility with transforms. More...
 
void InspectionBufferApplyTransforms (InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
 
void DetectBufferTypeCloseRegistration (void)
 
int DetectEngineBufferTypeGetByIdTransforms (DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
 
bool DetectEnginePktInspectionRun (ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
 
int DetectEnginePktInspectionSetup (Signature *s)
 
int DetectEngineReloadStart (void)
 
int DetectEngineReloadIsStart (void)
 
void DetectEngineReloadSetIdle (void)
 
int DetectEngineReloadIsIdle (void)
 
uint8_t DetectEngineInspectGenericList (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 Do the content inspection & validation for a signature. More...
 
uint8_t DetectEngineInspectBufferGeneric (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 Do the content inspection & validation for a signature. More...
 
int DetectEngineInspectPktBufferGeneric (DetectEngineThreadCtx *det_ctx, const DetectEnginePktInspectionEngine *engine, const Signature *s, Packet *p, uint8_t *_alert_flags)
 Do the content inspection & validation for a signature. More...
 
DetectEngineCtxDetectEngineCtxInitStubForMT (void)
 
DetectEngineCtxDetectEngineCtxInitStubForDD (void)
 
DetectEngineCtxDetectEngineCtxInit (void)
 
DetectEngineCtxDetectEngineCtxInitWithPrefix (const char *prefix)
 
void DetectEngineCtxFree (DetectEngineCtx *de_ctx)
 Free a DetectEngineCtx:: More...
 
void DetectEngineResetMaxSigId (DetectEngineCtx *de_ctx)
 
TmEcode DetectEngineThreadCtxInit (ThreadVars *tv, void *initdata, void **data)
 initialize thread specific detection engine context More...
 
DetectEngineThreadCtxDetectEngineThreadCtxInitForReload (ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
 
TmEcode DetectEngineThreadCtxDeinit (ThreadVars *tv, void *data)
 
void DetectEngineThreadCtxInfo (ThreadVars *t, DetectEngineThreadCtx *det_ctx)
 
int DetectRegisterThreadCtxFuncs (DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *), int mode)
 Register Thread keyword context Funcs. More...
 
int DetectUnregisterThreadCtxFuncs (DetectEngineCtx *de_ctx, void *data, const char *name)
 Remove Thread keyword context registration. More...
 
void * DetectThreadCtxGetKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
 Retrieve thread local keyword ctx by id. More...
 
int DetectRegisterThreadCtxGlobalFuncs (const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
 Register Thread keyword context Funcs (Global) More...
 
void * DetectThreadCtxGetGlobalKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
 Retrieve thread local keyword ctx by id. More...
 
int DetectEngineEnabled (void)
 Check if detection is enabled. More...
 
uint32_t DetectEngineGetVersion (void)
 
void DetectEngineBumpVersion (void)
 
DetectEngineCtxDetectEngineGetCurrent (void)
 
DetectEngineCtxDetectEngineReference (DetectEngineCtx *de_ctx)
 
int DetectEngineMultiTenantEnabled (void)
 
int DetectEngineLoadTenantBlocking (uint32_t tenant_id, const char *yaml)
 Load a tenant and wait for loading to complete. More...
 
int DetectEngineReloadTenantBlocking (uint32_t tenant_id, const char *yaml, int reload_cnt)
 Reload a tenant and wait for loading to complete. More...
 
int DetectEngineMultiTenantSetup (void)
 setup multi-detect / multi-tenancy More...
 
int DetectEngineTentantRegisterLivedev (uint32_t tenant_id, int device_id)
 
int DetectEngineTentantRegisterVlanId (uint32_t tenant_id, uint16_t vlan_id)
 
int DetectEngineTentantUnregisterVlanId (uint32_t tenant_id, uint16_t vlan_id)
 
int DetectEngineTentantRegisterPcapFile (uint32_t tenant_id)
 
int DetectEngineTentantUnregisterPcapFile (uint32_t tenant_id)
 
DetectEngineCtxDetectEngineGetByTenantId (int tenant_id)
 
void DetectEngineDeReference (DetectEngineCtx **de_ctx)
 
int DetectEngineAddToMaster (DetectEngineCtx *de_ctx)
 
int DetectEngineMoveToFreeList (DetectEngineCtx *de_ctx)
 
void DetectEnginePruneFreeList (void)
 
int DetectEngineReload (const SCInstance *suri)
 Reload the detection engine. More...
 
int DetectEngineMTApply (void)
 
void DetectEngineSetParseMetadata (void)
 
void DetectEngineUnsetParseMetadata (void)
 
int DetectEngineMustParseMetadata (void)
 
const char * DetectSigmatchListEnumToString (enum DetectSigmatchListEnum type)
 
void DetectEngineSetEvent (DetectEngineThreadCtx *det_ctx, uint8_t e)
 
AppLayerDecoderEventsDetectEngineGetEvents (DetectEngineThreadCtx *det_ctx)
 
int DetectEngineGetEventInfo (const char *event_name, int *event_id, AppLayerEventType *event_type)
 
void DetectEngineRegisterTests ()
 

Variables

SCEnumCharMap det_ctx_event_table []
 

Detailed Description

Macro Definition Documentation

◆ DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT

#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT   3000

Definition at line 92 of file detect-engine.c.

Typedef Documentation

◆ DetectEngineSyncer

◆ TenantLoaderCtx

Enumeration Type Documentation

◆ DetectEngineSyncState

Enumerator
IDLE 

ready to start a reload

RELOAD 

command main thread to do the reload

Definition at line 1878 of file detect-engine.c.

Function Documentation

◆ DetectAppLayerInspectEngineRegister2()

void DetectAppLayerInspectEngineRegister2 ( const char *  name,
AppProto  alproto,
uint32_t  dir,
int  progress,
InspectEngineFuncPtr2  Callback2,
InspectionBufferGetDataPtr  GetData 
)

register inspect engine at start up time

Registers an app inspection engine.

Note
errors are fatal

Definition at line 227 of file detect-engine.c.

◆ DetectBufferGetActiveList()

◆ DetectBufferSetActiveList()

int DetectBufferSetActiveList ( Signature s,
const int  list 
)

Definition at line 1299 of file detect-engine.c.

◆ DetectBufferTypeCloseRegistration()

void DetectBufferTypeCloseRegistration ( void  )

Definition at line 1657 of file detect-engine.c.

References BUG_ON.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectBufferTypeGetByName()

int DetectBufferTypeGetByName ( const char *  name)

◆ DetectBufferTypeGetDescriptionByName()

const char* DetectBufferTypeGetDescriptionByName ( const char *  name)

Definition at line 1202 of file detect-engine.c.

◆ DetectBufferTypeMaxId()

int DetectBufferTypeMaxId ( void  )

Definition at line 921 of file detect-engine.c.

Referenced by SigAlloc().

Here is the caller graph for this function:

◆ DetectBufferTypeRegister()

int DetectBufferTypeRegister ( const char *  name)

Definition at line 1031 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameInspectEngineRegister(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeRegisterSetupCallback()

void DetectBufferTypeRegisterSetupCallback ( const char *  name,
void(*)(const DetectEngineCtx *, Signature *)  SetupCallback 
)

Definition at line 1261 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeRegisterValidateCallback()

void DetectBufferTypeRegisterValidateCallback ( const char *  name,
bool(*)(const Signature *, const char **sigerror)  ValidateCallback 
)

Definition at line 1279 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSetDescriptionByName()

void DetectBufferTypeSetDescriptionByName ( const char *  name,
const char *  desc 
)

Definition at line 1182 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsFrames()

void DetectBufferTypeSupportsFrames ( const char *  name)

Definition at line 1045 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsMpm()

void DetectBufferTypeSupportsMpm ( const char *  name)

Definition at line 1065 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsPacket()

void DetectBufferTypeSupportsPacket ( const char *  name)

Definition at line 1055 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsTransformations()

void DetectBufferTypeSupportsTransformations ( const char *  name)

Definition at line 1075 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineAddToMaster()

int DetectEngineAddToMaster ( DetectEngineCtx de_ctx)

Definition at line 4331 of file detect-engine.c.

References de_ctx, and SCLogDebug.

◆ DetectEngineAppInspectionEngine2Signature()

◆ DetectEngineAppInspectionEngineSignatureFree()

void DetectEngineAppInspectionEngineSignatureFree ( DetectEngineCtx de_ctx,
Signature s 
)

free app inspect engines for a signature

For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.

Definition at line 842 of file detect-engine.c.

References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, MAX, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::sm_list, DetectEnginePktInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.

◆ DetectEngineBufferRunSetupCallback()

void DetectEngineBufferRunSetupCallback ( const DetectEngineCtx de_ctx,
const int  id,
Signature s 
)

Definition at line 1271 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.

Here is the call graph for this function:

◆ DetectEngineBufferRunValidateCallback()

bool DetectEngineBufferRunValidateCallback ( const DetectEngineCtx de_ctx,
const int  id,
const Signature s,
const char **  sigerror 
)

Definition at line 1289 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::ValidateCallback.

Here is the call graph for this function:

◆ DetectEngineBufferTypeGetById()

◆ DetectEngineBufferTypeGetByIdTransforms()

◆ DetectEngineBufferTypeGetDescriptionById()

const char* DetectEngineBufferTypeGetDescriptionById ( const DetectEngineCtx de_ctx,
const int  id 
)

Definition at line 1193 of file detect-engine.c.

References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().

Here is the call graph for this function:

◆ DetectEngineBufferTypeGetNameById()

const char* DetectEngineBufferTypeGetNameById ( const DetectEngineCtx de_ctx,
const int  id 
)

Definition at line 1115 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.

Referenced by DumpPatterns(), EngineAnalysisRules2(), and SignatureIsIPOnly().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegister()

int DetectEngineBufferTypeRegister ( DetectEngineCtx de_ctx,
const char *  name 
)

Definition at line 1172 of file detect-engine.c.

Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegisterWithFrameEngines()

int DetectEngineBufferTypeRegisterWithFrameEngines ( DetectEngineCtx de_ctx,
const char *  name,
const int  direction,
const AppProto  alproto,
const uint8_t  frame_type 
)

Definition at line 1138 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsFrames()

void DetectEngineBufferTypeSupportsFrames ( DetectEngineCtx de_ctx,
const char *  name 
)

Definition at line 1211 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMpm()

void DetectEngineBufferTypeSupportsMpm ( DetectEngineCtx de_ctx,
const char *  name 
)

Definition at line 1227 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMpmGetById()

bool DetectEngineBufferTypeSupportsMpmGetById ( const DetectEngineCtx de_ctx,
const int  id 
)

Definition at line 1252 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.

Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsPacket()

void DetectEngineBufferTypeSupportsPacket ( DetectEngineCtx de_ctx,
const char *  name 
)

Definition at line 1219 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsPacketGetById()

bool DetectEngineBufferTypeSupportsPacketGetById ( const DetectEngineCtx de_ctx,
const int  id 
)

Definition at line 1243 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.

Here is the call graph for this function:

◆ DetectEngineBufferTypeSupportsTransformations()

void DetectEngineBufferTypeSupportsTransformations ( DetectEngineCtx de_ctx,
const char *  name 
)

Definition at line 1235 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeValidateTransform()

bool DetectEngineBufferTypeValidateTransform ( DetectEngineCtx de_ctx,
int  sm_list,
const uint8_t *  content,
uint16_t  content_len,
const char **  namestr 
)

Check content byte array compatibility with transforms.

The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.

When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first positive validation result terminates the loop.

Parameters
de_ctxDetection engine context.
sm_listThe SM list id.
contentThe byte array being validated
namestrreturns the name of the transform that is incompatible with content.
Return values
true(false) If any of the transforms indicate the byte array is (is not) compatible.

Definition at line 1526 of file detect-engine.c.

References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.

Referenced by DetectContentSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBumpVersion()

void DetectEngineBumpVersion ( void  )

Definition at line 3601 of file detect-engine.c.

◆ DetectEngineCtxFree()

◆ DetectEngineCtxInit()

DetectEngineCtx* DetectEngineCtxInit ( void  )

Definition at line 2405 of file detect-engine.c.

Referenced by DetectEngineCtxInitWithPrefix(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().

Here is the caller graph for this function:

◆ DetectEngineCtxInitStubForDD()

DetectEngineCtx* DetectEngineCtxInitStubForDD ( void  )

Definition at line 2400 of file detect-engine.c.

◆ DetectEngineCtxInitStubForMT()

DetectEngineCtx* DetectEngineCtxInitStubForMT ( void  )

Definition at line 2395 of file detect-engine.c.

◆ DetectEngineCtxInitWithPrefix()

DetectEngineCtx* DetectEngineCtxInitWithPrefix ( const char *  prefix)

Definition at line 2410 of file detect-engine.c.

References DetectEngineCtxInit().

Here is the call graph for this function:

◆ DetectEngineDeReference()

void DetectEngineDeReference ( DetectEngineCtx **  de_ctx)

Definition at line 4307 of file detect-engine.c.

References BUG_ON, and de_ctx.

◆ DetectEngineEnabled()

int DetectEngineEnabled ( void  )

Check if detection is enabled.

Return values
booltrue or false

Definition at line 3577 of file detect-engine.c.

◆ DetectEngineFrameInspectEngineRegister()

◆ DetectEngineGetByTenantId()

DetectEngineCtx* DetectEngineGetByTenantId ( int  tenant_id)

Definition at line 4281 of file detect-engine.c.

◆ DetectEngineGetCurrent()

DetectEngineCtx* DetectEngineGetCurrent ( void  )

Definition at line 3610 of file detect-engine.c.

Referenced by DetectEngineThreadCtxInit().

Here is the caller graph for this function:

◆ DetectEngineGetEventInfo()

int DetectEngineGetEventInfo ( const char *  event_name,
int *  event_id,
AppLayerEventType event_type 
)

Definition at line 4651 of file detect-engine.c.

References APP_LAYER_EVENT_TYPE_TRANSACTION, det_ctx_event_table, SC_ERR_INVALID_ENUM_MAP, SCLogError, and SCMapEnumNameToValue().

Here is the call graph for this function:

◆ DetectEngineGetEvents()

AppLayerDecoderEvents* DetectEngineGetEvents ( DetectEngineThreadCtx det_ctx)

Definition at line 4646 of file detect-engine.c.

References DetectEngineThreadCtx_::decoder_events.

◆ DetectEngineGetVersion()

uint32_t DetectEngineGetVersion ( void  )

Definition at line 3591 of file detect-engine.c.

References version.

◆ DetectEngineInspectBufferGeneric()

uint8_t DetectEngineInspectBufferGeneric ( DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const DetectEngineAppInspectionEngine engine,
const Signature s,
Flow f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

◆ DetectEngineInspectGenericList()

uint8_t DetectEngineInspectGenericList ( DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
const struct DetectEngineAppInspectionEngine_ engine,
const Signature s,
Flow f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
smSigMatch to inspect
fFlow
flagsapp layer flags
stateApp layer state
Return values
0no match
1match

Definition at line 1950 of file detect-engine.c.

References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.

◆ DetectEngineInspectPktBufferGeneric()

◆ DetectEngineLoadTenantBlocking()

int DetectEngineLoadTenantBlocking ( uint32_t  tenant_id,
const char *  yaml 
)

Load a tenant and wait for loading to complete.

Definition at line 3836 of file detect-engine.c.

◆ DetectEngineMoveToFreeList()

int DetectEngineMoveToFreeList ( DetectEngineCtx de_ctx)

Definition at line 4347 of file detect-engine.c.

◆ DetectEngineMTApply()

int DetectEngineMTApply ( void  )

Definition at line 4541 of file detect-engine.c.

◆ DetectEngineMultiTenantEnabled()

int DetectEngineMultiTenantEnabled ( void  )

TODO locking? Not needed if this is a one time setting at startup

Definition at line 3642 of file detect-engine.c.

◆ DetectEngineMultiTenantSetup()

int DetectEngineMultiTenantSetup ( void  )

setup multi-detect / multi-tenancy

See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.

Definition at line 3982 of file detect-engine.c.

References TENANT_SELECTOR_UNKNOWN.

◆ DetectEngineMustParseMetadata()

int DetectEngineMustParseMetadata ( void  )

Definition at line 4606 of file detect-engine.c.

Referenced by DetectMetadataHashInit().

Here is the caller graph for this function:

◆ DetectEnginePktInspectionRun()

bool DetectEnginePktInspectionRun ( ThreadVars tv,
DetectEngineThreadCtx det_ctx,
const Signature s,
Flow f,
Packet p,
uint8_t *  alert_flags 
)

◆ DetectEnginePktInspectionSetup()

int DetectEnginePktInspectionSetup ( Signature s)

◆ DetectEnginePruneFreeList()

void DetectEnginePruneFreeList ( void  )

Definition at line 4398 of file detect-engine.c.

◆ DetectEngineReference()

DetectEngineCtx* DetectEngineReference ( DetectEngineCtx de_ctx)

Definition at line 3633 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::ref_cnt.

Referenced by DetectEngineThreadCtxInitForReload().

Here is the caller graph for this function:

◆ DetectEngineRegisterTests()

void DetectEngineRegisterTests ( )

Definition at line 4870 of file detect-engine.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ DetectEngineReload()

int DetectEngineReload ( const SCInstance suri)

Reload the detection engine.

Parameters
filenameYAML file to load for the detect config
Return values
-1error
0ok

Definition at line 4437 of file detect-engine.c.

References SCInstance_::conf_filename, and SCLogNotice.

◆ DetectEngineReloadIsIdle()

int DetectEngineReloadIsIdle ( void  )

Definition at line 1926 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadIsStart()

int DetectEngineReloadIsStart ( void  )

Definition at line 1906 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadSetIdle()

void DetectEngineReloadSetIdle ( void  )

Definition at line 1918 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadStart()

int DetectEngineReloadStart ( void  )

Definition at line 1892 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadTenantBlocking()

int DetectEngineReloadTenantBlocking ( uint32_t  tenant_id,
const char *  yaml,
int  reload_cnt 
)

Reload a tenant and wait for loading to complete.

Definition at line 3850 of file detect-engine.c.

◆ DetectEngineResetMaxSigId()

void DetectEngineResetMaxSigId ( DetectEngineCtx de_ctx)

Definition at line 2826 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::signum.

Referenced by SigCleanSignatures().

Here is the caller graph for this function:

◆ DetectEngineSetEvent()

void DetectEngineSetEvent ( DetectEngineThreadCtx det_ctx,
uint8_t  e 
)

Definition at line 4640 of file detect-engine.c.

References AppLayerDecoderEventsSetEventRaw(), DetectEngineThreadCtx_::decoder_events, and DetectEngineThreadCtx_::events.

Referenced by FileSwfDecompression(), FileSwfLzmaDecompression(), FileSwfZlibDecompression(), and InspectionBufferMultipleForListGet().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineSetParseMetadata()

void DetectEngineSetParseMetadata ( void  )

Definition at line 4596 of file detect-engine.c.

◆ DetectEngineTentantRegisterLivedev()

int DetectEngineTentantRegisterLivedev ( uint32_t  tenant_id,
int  device_id 
)

Definition at line 4249 of file detect-engine.c.

◆ DetectEngineTentantRegisterPcapFile()

int DetectEngineTentantRegisterPcapFile ( uint32_t  tenant_id)

Definition at line 4264 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTentantRegisterVlanId()

int DetectEngineTentantRegisterVlanId ( uint32_t  tenant_id,
uint16_t  vlan_id 
)

Definition at line 4254 of file detect-engine.c.

◆ DetectEngineTentantUnregisterPcapFile()

int DetectEngineTentantUnregisterPcapFile ( uint32_t  tenant_id)

Definition at line 4270 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTentantUnregisterVlanId()

int DetectEngineTentantUnregisterVlanId ( uint32_t  tenant_id,
uint16_t  vlan_id 
)

Definition at line 4259 of file detect-engine.c.

◆ DetectEngineThreadCtxDeinit()

TmEcode DetectEngineThreadCtxDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 3367 of file detect-engine.c.

References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SC_ERR_INVALID_ARGUMENTS, SCLogWarning, and TM_ECODE_OK.

Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineThreadCtxInfo()

void DetectEngineThreadCtxInfo ( ThreadVars t,
DetectEngineThreadCtx det_ctx 
)

◆ DetectEngineThreadCtxInit()

TmEcode DetectEngineThreadCtxInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

initialize thread specific detection engine context

Note
there is a special case when using delayed detect. In this case the function is called twice per thread. The first time the rules are not yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd time they will be loaded. de_ctx->delayed_detect_initialized will be 1. This is needed to do the per thread counter registration before the packet runtime starts. In delayed detect mode, the first call will return a NULL ptr through the data ptr.
Parameters
tvThreadVars for this thread
initdatapointer to de_ctx
data[out]pointer to store our thread detection ctx
Return values
TM_ECODE_OKif all went well
TM_ECODE_FAILEDon serious errors

alert counter setup

Definition at line 3153 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCMalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineThreadCtxInitForReload()

DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload ( ThreadVars tv,
DetectEngineCtx new_de_ctx,
int  mt 
)

◆ DetectEngineUnsetParseMetadata()

void DetectEngineUnsetParseMetadata ( void  )

Definition at line 4601 of file detect-engine.c.

◆ DetectFrameInspectEngineRegister()

◆ DetectPktInspectEngineRegister()

◆ DetectRegisterThreadCtxFuncs()

int DetectRegisterThreadCtxFuncs ( DetectEngineCtx de_ctx,
const char *  name,
void *(*)(void *)  InitFunc,
void *  data,
void(*)(void *)  FreeFunc,
int  mode 
)

Register Thread keyword context Funcs.

Parameters
de_ctxdetection engine to register in
namekeyword name for error printing
InitFuncfunction ptr
datakeyword init data to pass to Func. Can be NULL.
FreeFuncfunction ptr
mode0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct)
Return values
idfor retrieval of ctx at runtime
-1on error
Note
make sure "data" remains valid and it free'd elsewhere. It's recommended to store it in the keywords global ctx so that it's freed when the de_ctx is freed.

Definition at line 3431 of file detect-engine.c.

References BUG_ON, de_ctx, HashListTableInit(), and DetectEngineCtx_::keyword_hash.

Here is the call graph for this function:

◆ DetectRegisterThreadCtxGlobalFuncs()

int DetectRegisterThreadCtxGlobalFuncs ( const char *  name,
void *(*)(void *)  InitFunc,
void *  data,
void(*)(void *)  FreeFunc 
)

Register Thread keyword context Funcs (Global)

IDs stay static over reloads and between tenants

Parameters
namekeyword name for error printing
InitFuncfunction ptr
FreeFuncfunction ptr
Return values
idfor retrieval of ctx at runtime
-1on error

Definition at line 3521 of file detect-engine.c.

References BUG_ON.

◆ DetectSigmatchListEnumToString()

◆ DetectThreadCtxGetGlobalKeywordThreadCtx()

void* DetectThreadCtxGetGlobalKeywordThreadCtx ( DetectEngineThreadCtx det_ctx,
int  id 
)

Retrieve thread local keyword ctx by id.

Parameters
det_ctxdetection engine thread ctx to retrieve the ctx from
idid of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.
Return values
ctxor NULL on error

Definition at line 3565 of file detect-engine.c.

References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.

Referenced by HttpHeaderGetBufferSpace().

Here is the caller graph for this function:

◆ DetectThreadCtxGetKeywordThreadCtx()

void* DetectThreadCtxGetKeywordThreadCtx ( DetectEngineThreadCtx det_ctx,
int  id 
)

Retrieve thread local keyword ctx by id.

Parameters
det_ctxdetection engine thread ctx to retrieve the ctx from
idid of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.
Return values
ctxor NULL on error

Definition at line 3501 of file detect-engine.c.

References DetectEngineThreadCtx_::keyword_ctxs_array, and DetectEngineThreadCtx_::keyword_ctxs_size.

Referenced by DetectPcrePayloadMatch().

Here is the caller graph for this function:

◆ DetectUnregisterThreadCtxFuncs()

int DetectUnregisterThreadCtxFuncs ( DetectEngineCtx de_ctx,
void *  data,
const char *  name 
)

Remove Thread keyword context registration.

Parameters
de_ctxdetection engine to deregister from
det_ctxdetection engine thread context to deregister from
datakeyword init data to pass to Func. Can be NULL.
namekeyword name for error printing
Return values
1Item unregistered
0otherwise
Note
make sure "data" remains valid and it free'd elsewhere. It's recommended to store it in the keywords global ctx so that it's freed when the de_ctx is freed.

Definition at line 3483 of file detect-engine.c.

References DetectEngineThreadKeywordCtxItem_::data, de_ctx, HashListTableRemove(), and DetectEngineCtx_::keyword_hash.

Here is the call graph for this function:

◆ InspectionBufferApplyTransforms()

void InspectionBufferApplyTransforms ( InspectionBuffer buffer,
const DetectEngineTransforms transforms 
)

◆ InspectionBufferCheckAndExpand()

void InspectionBufferCheckAndExpand ( InspectionBuffer buffer,
uint32_t  min_size 
)

make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary

Definition at line 1479 of file detect-engine.c.

References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.

Referenced by FileSwfDecompression(), and InspectionBufferCopy().

Here is the caller graph for this function:

◆ InspectionBufferClean()

◆ InspectionBufferCopy()

void InspectionBufferCopy ( InspectionBuffer buffer,
uint8_t *  buf,
uint32_t  buf_len 
)

Definition at line 1496 of file detect-engine.c.

References InspectionBuffer::buf, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.

Referenced by Ja3DetectGetHash().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ InspectionBufferFree()

void InspectionBufferFree ( InspectionBuffer buffer)

Definition at line 1467 of file detect-engine.c.

References InspectionBuffer::buf, and SCFree.

◆ InspectionBufferGet()

InspectionBuffer* InspectionBufferGet ( DetectEngineThreadCtx det_ctx,
const int  list_id 
)

Definition at line 1368 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, and DetectEngineThreadCtx_::inspect.

Referenced by InspectionBufferSetup(), Ja3DetectGetHash(), and Ja3DetectGetString().

Here is the caller graph for this function:

◆ InspectionBufferInit()

void InspectionBufferInit ( InspectionBuffer buffer,
uint32_t  initial_size 
)

Definition at line 1425 of file detect-engine.c.

References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.

◆ InspectionBufferMultipleForListGet()

InspectionBuffer* InspectionBufferMultipleForListGet ( DetectEngineThreadCtx det_ctx,
const int  list_id,
const uint32_t  local_id 
)

for a InspectionBufferMultipleForList get a InspectionBuffer

Parameters
fbthe multiple buffer array
local_idthe index to get a buffer
bufferthe inspect buffer or NULL in case of error

Definition at line 1388 of file detect-engine.c.

References DETECT_EVENT_TOO_MANY_BUFFERS, DetectEngineSetEvent(), and unlikely.

Referenced by DetectFrame2InspectBuffer().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ InspectionBufferSetup()

void InspectionBufferSetup ( DetectEngineThreadCtx det_ctx,
const int  list_id,
InspectionBuffer buffer,
const uint8_t *  data,
const uint32_t  data_len 
)

◆ InspectionBufferSetupMulti()

void InspectionBufferSetupMulti ( InspectionBuffer buffer,
const DetectEngineTransforms transforms,
const uint8_t *  data,
const uint32_t  data_len 
)

setup the buffer with our initial data

Definition at line 1435 of file detect-engine.c.

References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferApplyTransforms(), InspectionBuffer::len, InspectionBuffer::orig, and InspectionBuffer::orig_len.

Here is the call graph for this function:

Variable Documentation

◆ det_ctx_event_table

SCEnumCharMap det_ctx_event_table[]
Initial value:
= {
{ "TEST", DET_CTX_EVENT_TEST },
{ "NO_MEMORY", FILE_DECODER_EVENT_NO_MEM },
{ "INVALID_SWF_LENGTH", FILE_DECODER_EVENT_INVALID_SWF_LENGTH },
{ "INVALID_SWF_VERSION", FILE_DECODER_EVENT_INVALID_SWF_VERSION },
{ "Z_DATA_ERROR", FILE_DECODER_EVENT_Z_DATA_ERROR },
{ "Z_STREAM_ERROR", FILE_DECODER_EVENT_Z_STREAM_ERROR },
{ "Z_BUF_ERROR", FILE_DECODER_EVENT_Z_BUF_ERROR },
{ "Z_UNKNOWN_ERROR", FILE_DECODER_EVENT_Z_UNKNOWN_ERROR },
{ "LZMA_IO_ERROR", FILE_DECODER_EVENT_LZMA_IO_ERROR },
{ "LZMA_HEADER_TOO_SHORT_ERROR", FILE_DECODER_EVENT_LZMA_HEADER_TOO_SHORT_ERROR },
{ "LZMA_DECODER_ERROR", FILE_DECODER_EVENT_LZMA_DECODER_ERROR },
{ "LZMA_MEMLIMIT_ERROR", FILE_DECODER_EVENT_LZMA_MEMLIMIT_ERROR },
{ "LZMA_XZ_ERROR", FILE_DECODER_EVENT_LZMA_XZ_ERROR },
{ "LZMA_UNKNOWN_ERROR", FILE_DECODER_EVENT_LZMA_UNKNOWN_ERROR },
{
"TOO_MANY_BUFFERS",
},
{ NULL, -1 },
}

Definition at line 109 of file detect-engine.c.

Referenced by DetectEngineGetEventInfo().

FILE_DECODER_EVENT_NO_MEM
@ FILE_DECODER_EVENT_NO_MEM
Definition: detect.h:1247
FILE_DECODER_EVENT_LZMA_HEADER_TOO_SHORT_ERROR
@ FILE_DECODER_EVENT_LZMA_HEADER_TOO_SHORT_ERROR
Definition: detect.h:1255
DET_CTX_EVENT_TEST
@ DET_CTX_EVENT_TEST
Definition: detect.h:1245
FILE_DECODER_EVENT_Z_UNKNOWN_ERROR
@ FILE_DECODER_EVENT_Z_UNKNOWN_ERROR
Definition: detect.h:1253
FILE_DECODER_EVENT_INVALID_SWF_VERSION
@ FILE_DECODER_EVENT_INVALID_SWF_VERSION
Definition: detect.h:1249
FILE_DECODER_EVENT_LZMA_XZ_ERROR
@ FILE_DECODER_EVENT_LZMA_XZ_ERROR
Definition: detect.h:1258
FILE_DECODER_EVENT_Z_BUF_ERROR
@ FILE_DECODER_EVENT_Z_BUF_ERROR
Definition: detect.h:1252
FILE_DECODER_EVENT_INVALID_SWF_LENGTH
@ FILE_DECODER_EVENT_INVALID_SWF_LENGTH
Definition: detect.h:1248
FILE_DECODER_EVENT_LZMA_UNKNOWN_ERROR
@ FILE_DECODER_EVENT_LZMA_UNKNOWN_ERROR
Definition: detect.h:1259
FILE_DECODER_EVENT_LZMA_IO_ERROR
@ FILE_DECODER_EVENT_LZMA_IO_ERROR
Definition: detect.h:1254
FILE_DECODER_EVENT_Z_DATA_ERROR
@ FILE_DECODER_EVENT_Z_DATA_ERROR
Definition: detect.h:1250
FILE_DECODER_EVENT_LZMA_MEMLIMIT_ERROR
@ FILE_DECODER_EVENT_LZMA_MEMLIMIT_ERROR
Definition: detect.h:1257
DETECT_EVENT_TOO_MANY_BUFFERS
@ DETECT_EVENT_TOO_MANY_BUFFERS
Definition: detect.h:1261
FILE_DECODER_EVENT_Z_STREAM_ERROR
@ FILE_DECODER_EVENT_Z_STREAM_ERROR
Definition: detect.h:1251
FILE_DECODER_EVENT_LZMA_DECODER_ERROR
@ FILE_DECODER_EVENT_LZMA_DECODER_ERROR
Definition: detect.h:1256