#include "suricata-common.h"
#include "suricata.h"
#include "detect.h"
#include "flow.h"
#include "flow-private.h"
#include "flow-util.h"
#include "flow-worker.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "datasets.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-tag.h"
#include "detect-engine-frame.h"
#include "detect-engine-file.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
#include "detect-fast-pattern.h"
#include "detect-byte-extract.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-tcphdr.h"
#include "detect-engine-threshold.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-loader.h"
#include "detect-engine-alert.h"
#include "util-classification-config.h"
#include "util-reference-config.h"
#include "util-threshold-config.h"
#include "util-error.h"
#include "util-hash.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-action.h"
#include "util-magic.h"
#include "util-signal.h"
#include "util-spm.h"
#include "util-device.h"
#include "util-var-name.h"
#include "util-path.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-hash-string.h"
#include "util-enum.h"
#include "util-conf.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "reputation.h"
#include "util-hash-lookup3.h"

Data Structures
struct	DetectEngineSyncer_

struct	TenantLoaderCtx_

Macros
#define	DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000

Typedefs
typedef struct DetectEngineSyncer_	DetectEngineSyncer

typedef struct TenantLoaderCtx_	TenantLoaderCtx

Enumerations
enum	DetectEngineSyncState { IDLE, RELOAD }

Functions
void	DetectPktInspectEngineRegister (const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
	register inspect engine at start up time More...

void	DetectAppLayerInspectEngineRegister (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
	Registers an app inspection engine. More...

void	DetectEngineFrameInspectEngineRegister (DetectEngineCtx de_ctx, const char name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
	register inspect engine at start up time More...

int	DetectEngineAppInspectionEngine2Signature (DetectEngineCtx de_ctx, Signature s)

void	DetectEngineAppInspectionEngineSignatureFree (DetectEngineCtx de_ctx, Signature s)
	free app inspect engines for a signature More...

int	DetectBufferTypeMaxId (void)

int	DetectBufferTypeRegister (const char *name)

void	DetectBufferTypeSupportsMultiInstance (const char *name)

void	DetectBufferTypeSupportsFrames (const char *name)

void	DetectBufferTypeSupportsPacket (const char *name)

void	DetectBufferTypeSupportsMpm (const char *name)

void	DetectBufferTypeSupportsTransformations (const char *name)

int	DetectBufferTypeGetByName (const char *name)

const DetectBufferType *	DetectEngineBufferTypeGetById (const DetectEngineCtx *de_ctx, const int id)

const char *	DetectEngineBufferTypeGetNameById (const DetectEngineCtx *de_ctx, const int id)

int	DetectEngineBufferTypeRegisterWithFrameEngines (DetectEngineCtx de_ctx, const char name, const int direction, const AppProto alproto, const uint8_t frame_type)

int	DetectEngineBufferTypeRegister (DetectEngineCtx de_ctx, const char name)

void	DetectBufferTypeSetDescriptionByName (const char name, const char desc)

const char *	DetectEngineBufferTypeGetDescriptionById (const DetectEngineCtx *de_ctx, const int id)

const char *	DetectBufferTypeGetDescriptionByName (const char *name)

void	DetectEngineBufferTypeSupportsFrames (DetectEngineCtx de_ctx, const char name)

void	DetectEngineBufferTypeSupportsPacket (DetectEngineCtx de_ctx, const char name)

void	DetectEngineBufferTypeSupportsMpm (DetectEngineCtx de_ctx, const char name)

void	DetectEngineBufferTypeSupportsTransformations (DetectEngineCtx de_ctx, const char name)

bool	DetectEngineBufferTypeSupportsMultiInstanceGetById (const DetectEngineCtx *de_ctx, const int id)

bool	DetectEngineBufferTypeSupportsPacketGetById (const DetectEngineCtx *de_ctx, const int id)

bool	DetectEngineBufferTypeSupportsMpmGetById (const DetectEngineCtx *de_ctx, const int id)

bool	DetectEngineBufferTypeSupportsFramesGetById (const DetectEngineCtx *de_ctx, const int id)

void	DetectBufferTypeRegisterSetupCallback (const char name, void(SetupCallback)(const DetectEngineCtx , Signature ))

void	DetectEngineBufferRunSetupCallback (const DetectEngineCtx de_ctx, const int id, Signature s)

void	DetectBufferTypeRegisterValidateCallback (const char name, bool(ValidateCallback)(const Signature , const char *sigerror))

bool	DetectEngineBufferRunValidateCallback (const DetectEngineCtx de_ctx, const int id, const Signature s, const char **sigerror)

SigMatch *	DetectBufferGetFirstSigMatch (const Signature *s, const uint32_t buf_id)

SigMatch *	DetectBufferGetLastSigMatch (const Signature *s, const uint32_t buf_id)

bool	DetectBufferIsPresent (const Signature *s, const uint32_t buf_id)

int	DetectBufferSetActiveList (DetectEngineCtx de_ctx, Signature s, const int list)

int	DetectBufferGetActiveList (DetectEngineCtx de_ctx, Signature s)

void	InspectionBufferClean (DetectEngineThreadCtx *det_ctx)

InspectionBuffer *	InspectionBufferGet (DetectEngineThreadCtx *det_ctx, const int list_id)

InspectionBuffer *	InspectionBufferMultipleForListGet (DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
	for a InspectionBufferMultipleForList get a InspectionBuffer More...

void	InspectionBufferInit (InspectionBuffer *buffer, uint32_t initial_size)

void	InspectionBufferSetupMultiEmpty (InspectionBuffer *buffer)
	setup the buffer empty More...

void	InspectionBufferSetupMulti (InspectionBuffer buffer, const DetectEngineTransforms transforms, const uint8_t *data, const uint32_t data_len)
	setup the buffer with our initial data More...

void	InspectionBufferSetup (DetectEngineThreadCtx det_ctx, const int list_id, InspectionBuffer buffer, const uint8_t *data, const uint32_t data_len)
	setup the buffer with our initial data More...

void	InspectionBufferFree (InspectionBuffer *buffer)

void *	InspectionBufferCheckAndExpand (InspectionBuffer *buffer, uint32_t min_size)
	make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary More...

void	InspectionBufferTruncate (InspectionBuffer *buffer, uint32_t buf_len)

void	InspectionBufferCopy (InspectionBuffer buffer, uint8_t buf, uint32_t buf_len)

bool	DetectEngineBufferTypeValidateTransform (DetectEngineCtx de_ctx, int sm_list, const uint8_t content, uint16_t content_len, const char **namestr)
	Check content byte array compatibility with transforms. More...

void	InspectionBufferApplyTransforms (InspectionBuffer buffer, const DetectEngineTransforms transforms)

void	DetectBufferTypeCloseRegistration (void)

int	DetectEngineBufferTypeGetByIdTransforms (DetectEngineCtx de_ctx, const int id, TransformData transforms, int transform_cnt)

bool	DetectEnginePktInspectionRun (ThreadVars tv, DetectEngineThreadCtx det_ctx, const Signature s, Flow f, Packet p, uint8_t alert_flags)

int	DetectEnginePktInspectionSetup (Signature *s)

int	DetectEngineReloadStart (void)

int	DetectEngineReloadIsStart (void)

void	DetectEngineReloadSetIdle (void)

int	DetectEngineReloadIsIdle (void)

uint8_t	DetectEngineInspectGenericList (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const struct DetectEngineAppInspectionEngine_ engine, const Signature s, Flow f, uint8_t flags, void alstate, void *txv, uint64_t tx_id)
	Do the content inspection & validation for a signature. More...

uint8_t	DetectEngineInspectBufferGeneric (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const DetectEngineAppInspectionEngine engine, const Signature s, Flow f, uint8_t flags, void alstate, void *txv, uint64_t tx_id)
	Do the content inspection & validation for a signature. More...

void	DetectAppLayerMultiRegister (const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority, int tx_min_progress)

uint8_t	DetectEngineInspectMultiBufferGeneric (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const DetectEngineAppInspectionEngine engine, const Signature s, Flow f, uint8_t flags, void alstate, void *txv, uint64_t tx_id)

int	DetectEngineInspectPktBufferGeneric (DetectEngineThreadCtx det_ctx, const DetectEnginePktInspectionEngine engine, const Signature s, Packet p, uint8_t *_alert_flags)
	Do the content inspection & validation for a signature. More...

DetectEngineCtx *	DetectEngineCtxInitStubForMT (void)

DetectEngineCtx *	DetectEngineCtxInitStubForDD (void)

DetectEngineCtx *	DetectEngineCtxInit (void)

DetectEngineCtx *	DetectEngineCtxInitWithPrefix (const char *prefix, uint32_t tenant_id)

void	DetectEngineCtxFree (DetectEngineCtx *de_ctx)
	Free a DetectEngineCtx:: More...

void	DetectEngineResetMaxSigId (DetectEngineCtx *de_ctx)

TmEcode	DetectEngineThreadCtxInit (ThreadVars tv, void initdata, void **data)
	initialize thread specific detection engine context More...

DetectEngineThreadCtx *	DetectEngineThreadCtxInitForReload (ThreadVars tv, DetectEngineCtx new_de_ctx, int mt)

TmEcode	DetectEngineThreadCtxDeinit (ThreadVars tv, void data)

int	DetectRegisterThreadCtxFuncs (DetectEngineCtx de_ctx, const char name, void (InitFunc)(void ), void data, void(FreeFunc)(void ), int mode)
	Register Thread keyword context Funcs. More...

int	DetectUnregisterThreadCtxFuncs (DetectEngineCtx de_ctx, void data, const char *name)
	Remove Thread keyword context registration. More...

void *	DetectThreadCtxGetKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
	Retrieve thread local keyword ctx by id. More...

int	DetectRegisterThreadCtxGlobalFuncs (const char name, void (InitFunc)(void ), void data, void(FreeFunc)(void *))
	Register Thread keyword context Funcs (Global) More...

void *	DetectThreadCtxGetGlobalKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
	Retrieve thread local keyword ctx by id. More...

int	DetectEngineEnabled (void)
	Check if detection is enabled. More...

uint32_t	DetectEngineGetVersion (void)

void	DetectEngineBumpVersion (void)

DetectEngineCtx *	DetectEngineGetCurrent (void)

DetectEngineCtx *	DetectEngineReference (DetectEngineCtx *de_ctx)

int	DetectEngineMultiTenantEnabled (void)

int	DetectEngineLoadTenantBlocking (uint32_t tenant_id, const char *yaml)
	Load a tenant and wait for loading to complete. More...

int	DetectEngineReloadTenantBlocking (uint32_t tenant_id, const char *yaml, int reload_cnt)
	Reload a tenant and wait for loading to complete. More...

int	DetectEngineReloadTenantsBlocking (const int reload_cnt)
	Reload all tenants and wait for loading to complete. More...

int	DetectEngineMultiTenantSetup (const bool unix_socket)
	setup multi-detect / multi-tenancy More...

int	DetectEngineTenantRegisterLivedev (uint32_t tenant_id, int device_id)

int	DetectEngineTenantRegisterVlanId (uint32_t tenant_id, uint16_t vlan_id)

int	DetectEngineTenantUnregisterVlanId (uint32_t tenant_id, uint16_t vlan_id)

int	DetectEngineTenantRegisterPcapFile (uint32_t tenant_id)

int	DetectEngineTenantUnregisterPcapFile (uint32_t tenant_id)

DetectEngineCtx *	DetectEngineGetByTenantId (uint32_t tenant_id)

void	DetectEngineDeReference (DetectEngineCtx **de_ctx)

int	DetectEngineAddToMaster (DetectEngineCtx *de_ctx)

int	DetectEngineMoveToFreeList (DetectEngineCtx *de_ctx)

void	DetectEnginePruneFreeList (void)

void	DetectEngineClearMaster (void)

int	DetectEngineReload (const SCInstance *suri)
	Reload the detection engine. More...

int	DetectEngineMTApply (void)

void	DetectEngineSetParseMetadata (void)

void	DetectEngineUnsetParseMetadata (void)

int	DetectEngineMustParseMetadata (void)

const char *	DetectSigmatchListEnumToString (enum DetectSigmatchListEnum type)

void	DetectEngineSetEvent (DetectEngineThreadCtx *det_ctx, uint8_t e)

void	DetectEngineRegisterTests (void)

Variables
const struct SignatureProperties	signature_properties [SIG_TYPE_MAX]

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file detect-engine.c.

Macro Definition Documentation

◆ DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT

#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000

Definition at line 95 of file detect-engine.c.

Typedef Documentation

◆ DetectEngineSyncer

typedef struct DetectEngineSyncer_ DetectEngineSyncer

◆ TenantLoaderCtx

typedef struct TenantLoaderCtx_ TenantLoaderCtx

Enumeration Type Documentation

◆ DetectEngineSyncState

enum DetectEngineSyncState

Enumerator
IDLE	ready to start a reload
RELOAD	command main thread to do the reload

Definition at line 2040 of file detect-engine.c.

Function Documentation

◆ DetectAppLayerInspectEngineRegister()

void DetectAppLayerInspectEngineRegister	(	const char *	name,
		AppProto	alproto,
		uint32_t	dir,
		int	progress,
		InspectEngineFuncPtr	Callback2,
		InspectionBufferGetDataPtr	GetData
	)

Registers an app inspection engine.

Parameters

name	Name of the detection list
alproto	App layer protocol for which we will register the engine.
direction	The direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
progress	Minimal progress value for inspect engine to run
Callback	The engine callback.

Definition at line 240 of file detect-engine.c.

Referenced by DetectFileRegisterFileProtocols(), and DetectHelperBufferRegister().

Here is the caller graph for this function:

◆ DetectAppLayerMultiRegister()

void DetectAppLayerMultiRegister	(	const char *	name,
		AppProto	alproto,
		uint32_t	dir,
		int	progress,
		InspectionMultiBufferGetDataPtr	GetData,
		int	priority,
		int	tx_min_progress
	)

Definition at line 2205 of file detect-engine.c.

◆ DetectBufferGetActiveList()

int DetectBufferGetActiveList	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

Definition at line 1425 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, BUG_ON, DetectEngineTransforms::cnt, SignatureInitData_::curbuf, de_ctx, DEBUG_VALIDATE_BUG_ON, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_NOTSET, DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeSupportsMultiInstanceGetById(), SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::init_data, SignatureInitData_::list, SignatureInitData_::list_set, SignatureInitDataBuffer_::multi_capable, SCLogDebug, SCLogError, SCReturnInt, SignatureInitDataBufferCheckExpand(), DetectEngineTransforms::transforms, and SignatureInitData_::transforms.

Referenced by DetectContentSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectBufferGetFirstSigMatch()

SigMatch* DetectBufferGetFirstSigMatch	(	const Signature *	s,
		const uint32_t	buf_id
	)

Definition at line 1326 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, and Signature_::init_data.

◆ DetectBufferGetLastSigMatch()

SigMatch* DetectBufferGetLastSigMatch	(	const Signature *	s,
		const uint32_t	buf_id
	)

Definition at line 1336 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, Signature_::init_data, and SignatureInitDataBuffer_::tail.

◆ DetectBufferIsPresent()

bool DetectBufferIsPresent	(	const Signature *	s,
		const uint32_t	buf_id
	)

Definition at line 1347 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, and Signature_::init_data.

◆ DetectBufferSetActiveList()

int DetectBufferSetActiveList	(	DetectEngineCtx *	de_ctx,
		Signature *	s,
		const int	list
	)

Definition at line 1357 of file detect-engine.c.

◆ DetectBufferTypeCloseRegistration()

void DetectBufferTypeCloseRegistration ( void )

Definition at line 1818 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeGetByName()

int DetectBufferTypeGetByName ( const char * name )

Definition at line 1094 of file detect-engine.c.

Referenced by DetectEngineAppInspectionEngine2Signature(), DetectFrameMpmRegister(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeGetDescriptionByName()

const char* DetectBufferTypeGetDescriptionByName ( const char * name )

Definition at line 1211 of file detect-engine.c.

◆ DetectBufferTypeMaxId()

int DetectBufferTypeMaxId ( void )

Definition at line 922 of file detect-engine.c.

◆ DetectBufferTypeRegister()

int DetectBufferTypeRegister ( const char * name )

Definition at line 1030 of file detect-engine.c.

References BUG_ON.

Referenced by DetectHelperBufferRegister(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeRegisterSetupCallback()

void DetectBufferTypeRegisterSetupCallback	(	const char *	name,
		void()(const DetectEngineCtx , Signature *)	SetupCallback
	)

Definition at line 1288 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeRegisterValidateCallback()

void DetectBufferTypeRegisterValidateCallback	(	const char *	name,
		bool()(const Signature , const char **sigerror)	ValidateCallback
	)

Definition at line 1306 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSetDescriptionByName()

void DetectBufferTypeSetDescriptionByName	(	const char *	name,
		const char *	desc
	)

Definition at line 1191 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsFrames()

void DetectBufferTypeSupportsFrames ( const char * name )

Definition at line 1054 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsMpm()

void DetectBufferTypeSupportsMpm ( const char * name )

Definition at line 1074 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsMultiInstance()

void DetectBufferTypeSupportsMultiInstance ( const char * name )

Definition at line 1044 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsPacket()

void DetectBufferTypeSupportsPacket ( const char * name )

Definition at line 1064 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsTransformations()

void DetectBufferTypeSupportsTransformations ( const char * name )

Definition at line 1084 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineAddToMaster()

int DetectEngineAddToMaster ( DetectEngineCtx * de_ctx )

Definition at line 4643 of file detect-engine.c.

References de_ctx, and SCLogDebug.

◆ DetectEngineAppInspectionEngine2Signature()

int DetectEngineAppInspectionEngine2Signature	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

Note: for the file inspect engine, the id DE_STATE_ID_FILE_INSPECT is assigned.

Definition at line 729 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, de_ctx, DE_STATE_FLAG_BASE, DetectBufferTypeGetByName(), DetectEngineBufferTypeGetById(), FatalError, DetectBufferType_::frame, DetectEngineCtx_::frame_inspect_engines, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, DetectEngineFrameInspectionEngine::next, SCLogDebug, SigMatchList2DataArray(), and DetectEngineFrameInspectionEngine::sm_list.

Here is the call graph for this function:

◆ DetectEngineAppInspectionEngineSignatureFree()

void DetectEngineAppInspectionEngineSignatureFree	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

free app inspect engines for a signature

For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.

Definition at line 816 of file detect-engine.c.

References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.

◆ DetectEngineBufferRunSetupCallback()

void DetectEngineBufferRunSetupCallback	(	const DetectEngineCtx *	de_ctx,
		const int	id,
		Signature *	s
	)

Definition at line 1298 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.

Here is the call graph for this function:

◆ DetectEngineBufferRunValidateCallback()

bool DetectEngineBufferRunValidateCallback	(	const DetectEngineCtx *	de_ctx,
		const int	id,
		const Signature *	s,
		const char **	sigerror
	)

Definition at line 1316 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::ValidateCallback.

Here is the call graph for this function:

◆ DetectEngineBufferTypeGetById()

const DetectBufferType* DetectEngineBufferTypeGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1114 of file detect-engine.c.

References DetectEngineCtx_::buffer_type_hash_id, de_ctx, HashListTableLookup(), and DetectBufferType_::id.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetByIdTransforms()

int DetectEngineBufferTypeGetByIdTransforms	(	DetectEngineCtx *	de_ctx,
		const int	id,
		TransformData *	transforms,
		int	transform_cnt
	)

Definition at line 1825 of file detect-engine.c.

References DetectEngineCtx_::buffer_type_hash_id, DetectEngineCtx_::buffer_type_hash_name, DetectEngineCtx_::buffer_type_id, BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectAppLayerMpmRegisterByParentId(), DetectEngineBufferTypeGetById(), DetectFrameMpmRegisterByParentId(), DetectPktMpmRegisterByParentId(), DetectBufferType_::frame, HashListTableAdd(), HashListTableLookup(), DetectBufferType_::id, DetectBufferType_::mpm, DetectBufferType_::name, DetectBufferType_::packet, DetectBufferType_::parent_id, SCCalloc, SCLogDebug, SCLogError, DetectBufferType_::SetupCallback, strlcpy(), DetectBufferType_::supports_transforms, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and DetectBufferType_::ValidateCallback.

Referenced by DetectBufferGetActiveList().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetDescriptionById()

const char* DetectEngineBufferTypeGetDescriptionById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1202 of file detect-engine.c.

References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().

Referenced by EngineAnalysisFP().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetNameById()

const char* DetectEngineBufferTypeGetNameById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1124 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.

Referenced by DumpPatterns(), EngineAnalysisFP(), and EngineAnalysisRules2().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegister()

int DetectEngineBufferTypeRegister	(	DetectEngineCtx *	de_ctx,
		const char *	name
	)

Definition at line 1181 of file detect-engine.c.

Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegisterWithFrameEngines()

int DetectEngineBufferTypeRegisterWithFrameEngines	(	DetectEngineCtx *	de_ctx,
		const char *	name,
		const int	direction,
		const AppProto	alproto,
		const uint8_t	frame_type
	)

Definition at line 1147 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsFrames()

void DetectEngineBufferTypeSupportsFrames	(	DetectEngineCtx *	de_ctx,
		const char *	name
	)

Definition at line 1220 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsFramesGetById()

bool DetectEngineBufferTypeSupportsFramesGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1279 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::frame, and SCLogDebug.

Here is the call graph for this function:

◆ DetectEngineBufferTypeSupportsMpm()

void DetectEngineBufferTypeSupportsMpm	(	DetectEngineCtx *	de_ctx,
		const char *	name
	)

Definition at line 1236 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMpmGetById()

bool DetectEngineBufferTypeSupportsMpmGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1270 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.

Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMultiInstanceGetById()

bool DetectEngineBufferTypeSupportsMultiInstanceGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1252 of file detect-engine.c.

References BOOL2STR, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::multi_instance, and SCLogDebug.

Referenced by DetectBufferGetActiveList().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsPacket()

void DetectEngineBufferTypeSupportsPacket	(	DetectEngineCtx *	de_ctx,
		const char *	name
	)

Definition at line 1228 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsPacketGetById()

bool DetectEngineBufferTypeSupportsPacketGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 1261 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.

Here is the call graph for this function:

◆ DetectEngineBufferTypeSupportsTransformations()

void DetectEngineBufferTypeSupportsTransformations	(	DetectEngineCtx *	de_ctx,
		const char *	name
	)

Definition at line 1244 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeValidateTransform()

bool DetectEngineBufferTypeValidateTransform	(	DetectEngineCtx *	de_ctx,
		int	sm_list,
		const uint8_t *	content,
		uint16_t	content_len,
		const char **	namestr
	)

Check content byte array compatibility with transforms.

The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.

When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first validation failure terminates the loop.

Parameters

de_ctx	Detection engine context.
sm_list	The SM list id.
content	The byte array being validated
namestr	returns the name of the transform that is incompatible with content.

Return values

true	(false) If any of the transforms indicate the byte array is (is not) compatible.

Definition at line 1687 of file detect-engine.c.

References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.

Referenced by DetectContentSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineBumpVersion()

void DetectEngineBumpVersion ( void )

Definition at line 3819 of file detect-engine.c.

◆ DetectEngineClearMaster()

void DetectEngineClearMaster ( void )

Definition at line 4743 of file detect-engine.c.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineCtxFree()

void DetectEngineCtxFree ( DetectEngineCtx * de_ctx )

Free a DetectEngineCtx::

Parameters

de_ctx DetectEngineCtx:: to be freed

Definition at line 2623 of file detect-engine.c.

References de_ctx, DetectEngineFreeFastPatternList(), DetectParseDupSigHashFree(), DetectEngineCtx_::filedata_config, MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::sm_types_prefilter, DetectEngineCtx_::sm_types_silent_error, DetectEngineCtx_::spm_global_thread_ctx, and SpmDestroyGlobalThreadCtx().

Referenced by LLVMFuzzerTestOneInput(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineCtxInit()

DetectEngineCtx* DetectEngineCtxInit ( void )

Definition at line 2584 of file detect-engine.c.

Referenced by DetectEngineCtxInitWithPrefix(), LLVMFuzzerTestOneInput(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().

Here is the caller graph for this function:

◆ DetectEngineCtxInitStubForDD()

DetectEngineCtx* DetectEngineCtxInitStubForDD ( void )

Definition at line 2579 of file detect-engine.c.

◆ DetectEngineCtxInitStubForMT()

DetectEngineCtx* DetectEngineCtxInitStubForMT ( void )

Definition at line 2574 of file detect-engine.c.

◆ DetectEngineCtxInitWithPrefix()

DetectEngineCtx* DetectEngineCtxInitWithPrefix	(	const char *	prefix,
		uint32_t	tenant_id
	)

Definition at line 2589 of file detect-engine.c.

References DetectEngineCtxInit().

Here is the call graph for this function:

◆ DetectEngineDeReference()

void DetectEngineDeReference ( DetectEngineCtx ** de_ctx )

Definition at line 4619 of file detect-engine.c.

References BUG_ON, and de_ctx.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineEnabled()

int DetectEngineEnabled ( void )

Check if detection is enabled.

Return values

bool	true or false

Definition at line 3795 of file detect-engine.c.

◆ DetectEngineFrameInspectEngineRegister()

void DetectEngineFrameInspectEngineRegister	(	DetectEngineCtx *	de_ctx,
		const char *	name,
		int	dir,
		InspectionBufferFrameInspectFunc	Callback,
		AppProto	alproto,
		uint8_t	type
	)

register inspect engine at start up time

Note: errors are fatal

Definition at line 379 of file detect-engine.c.

References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, de_ctx, DETECT_SM_LIST_MATCH, DetectEngineBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, DetectEngineCtx_::frame_inspect_engines, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectEngineGetByTenantId()

DetectEngineCtx* DetectEngineGetByTenantId ( uint32_t tenant_id )

Definition at line 4593 of file detect-engine.c.

◆ DetectEngineGetCurrent()

DetectEngineCtx* DetectEngineGetCurrent ( void )

Definition at line 3828 of file detect-engine.c.

Referenced by DetectEngineThreadCtxInit(), and GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineGetVersion()

uint32_t DetectEngineGetVersion ( void )

Definition at line 3809 of file detect-engine.c.

References version.

◆ DetectEngineInspectBufferGeneric()

uint8_t DetectEngineInspectBufferGeneric	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const DetectEngineAppInspectionEngine *	engine,
		const Signature *	s,
		Flow *	f,
		uint8_t	flags,
		void *	alstate,
		void *	txv,
		uint64_t	tx_id
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
f	Flow
flags	app layer flags
state	App layer state

Return values

0	no match.
1	match.
2	Sig can't match.

Definition at line 2155 of file detect-engine.c.

Here is the call graph for this function:

◆ DetectEngineInspectGenericList()

uint8_t DetectEngineInspectGenericList	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const struct DetectEngineAppInspectionEngine_ *	engine,
		const Signature *	s,
		Flow *	f,
		uint8_t	flags,
		void *	alstate,
		void *	txv,
		uint64_t	tx_id
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
sm	SigMatch to inspect
f	Flow
flags	app layer flags
state	App layer state

Return values

0	no match
1	match

Definition at line 2112 of file detect-engine.c.

References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.

Referenced by DetectHelperBufferRegister().

Here is the caller graph for this function:

◆ DetectEngineInspectMultiBufferGeneric()

uint8_t DetectEngineInspectMultiBufferGeneric	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const DetectEngineAppInspectionEngine *	engine,
		const Signature *	s,
		Flow *	f,
		uint8_t	flags,
		void *	alstate,
		void *	txv,
		uint64_t	tx_id
	)

◆ DetectEngineInspectPktBufferGeneric()

int DetectEngineInspectPktBufferGeneric	(	DetectEngineThreadCtx *	det_ctx,
		const DetectEnginePktInspectionEngine *	engine,
		const Signature *	s,
		Packet *	p,
		uint8_t *	_alert_flags
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
p	Packet

Return values

0	no match.
1	match.

Definition at line 2262 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEnginePktInspectionEngine::mpm, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectEngineLoadTenantBlocking()

int DetectEngineLoadTenantBlocking	(	uint32_t	tenant_id,
		const char *	yaml
	)

Load a tenant and wait for loading to complete.

Definition at line 4117 of file detect-engine.c.

◆ DetectEngineMoveToFreeList()

int DetectEngineMoveToFreeList ( DetectEngineCtx * de_ctx )

Definition at line 4703 of file detect-engine.c.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineMTApply()

int DetectEngineMTApply ( void )

Definition at line 4890 of file detect-engine.c.

◆ DetectEngineMultiTenantEnabled()

int DetectEngineMultiTenantEnabled ( void )

TODO locking? Not needed if this is a one time setting at startup

Definition at line 3860 of file detect-engine.c.

◆ DetectEngineMultiTenantSetup()

int DetectEngineMultiTenantSetup ( const bool unix_socket )

setup multi-detect / multi-tenancy

See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.

Definition at line 4280 of file detect-engine.c.

References TENANT_SELECTOR_UNKNOWN.

◆ DetectEngineMustParseMetadata()

int DetectEngineMustParseMetadata ( void )

Definition at line 4957 of file detect-engine.c.

Referenced by DetectMetadataHashInit().

Here is the caller graph for this function:

◆ DetectEnginePktInspectionRun()

bool DetectEnginePktInspectionRun	(	ThreadVars *	tv,
		DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Flow *	f,
		Packet *	p,
		uint8_t *	alert_flags
	)

Definition at line 1970 of file detect-engine.c.

References DetectEnginePktInspectionEngine::Callback, DETECT_ENGINE_INSPECT_SIG_MATCH, Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, SCLogDebug, and DetectEnginePktInspectionEngine::v1.

◆ DetectEnginePktInspectionSetup()

int DetectEnginePktInspectionSetup ( Signature * s )

Definition at line 2018 of file detect-engine.c.

References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.

◆ DetectEnginePruneFreeList()

void DetectEnginePruneFreeList ( void )

Definition at line 4713 of file detect-engine.c.

◆ DetectEngineReference()

DetectEngineCtx* DetectEngineReference ( DetectEngineCtx * de_ctx )

Definition at line 3851 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::ref_cnt.

Referenced by DetectEngineThreadCtxInitForReload().

Here is the caller graph for this function:

◆ DetectEngineRegisterTests()

void DetectEngineRegisterTests ( void )

Definition at line 5199 of file detect-engine.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ DetectEngineReload()

int DetectEngineReload ( const SCInstance * suri )

Reload the detection engine.

Parameters

filename YAML file to load for the detect config

Return values

-1	error
0	ok

Definition at line 4770 of file detect-engine.c.

References SCInstance_::conf_filename, and SCLogNotice.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadIsIdle()

int DetectEngineReloadIsIdle ( void )

Definition at line 2088 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadIsStart()

int DetectEngineReloadIsStart ( void )

Definition at line 2068 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadSetIdle()

void DetectEngineReloadSetIdle ( void )

Definition at line 2080 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadStart()

int DetectEngineReloadStart ( void )

Definition at line 2054 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadTenantBlocking()

int DetectEngineReloadTenantBlocking	(	uint32_t	tenant_id,
		const char *	yaml,
		int	reload_cnt
	)

Reload a tenant and wait for loading to complete.

Definition at line 4131 of file detect-engine.c.

◆ DetectEngineReloadTenantsBlocking()

int DetectEngineReloadTenantsBlocking ( const int reload_cnt )

Reload all tenants and wait for loading to complete.

Definition at line 4145 of file detect-engine.c.

◆ DetectEngineResetMaxSigId()

void DetectEngineResetMaxSigId ( DetectEngineCtx * de_ctx )

Definition at line 3043 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::signum.

Referenced by SigCleanSignatures().

Here is the caller graph for this function:

◆ DetectEngineSetEvent()

void DetectEngineSetEvent	(	DetectEngineThreadCtx *	det_ctx,
		uint8_t	e
	)

Definition at line 4991 of file detect-engine.c.

References AppLayerDecoderEventsSetEventRaw(), DetectEngineThreadCtx_::decoder_events, and DetectEngineThreadCtx_::events.

Referenced by FileSwfDecompression(), FileSwfLzmaDecompression(), FileSwfZlibDecompression(), and InspectionBufferMultipleForListGet().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineSetParseMetadata()

void DetectEngineSetParseMetadata ( void )

Definition at line 4947 of file detect-engine.c.

◆ DetectEngineTenantRegisterLivedev()

int DetectEngineTenantRegisterLivedev	(	uint32_t	tenant_id,
		int	device_id
	)

Definition at line 4560 of file detect-engine.c.

◆ DetectEngineTenantRegisterPcapFile()

int DetectEngineTenantRegisterPcapFile ( uint32_t tenant_id )

Definition at line 4576 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTenantRegisterVlanId()

int DetectEngineTenantRegisterVlanId	(	uint32_t	tenant_id,
		uint16_t	vlan_id
	)

Definition at line 4566 of file detect-engine.c.

◆ DetectEngineTenantUnregisterPcapFile()

int DetectEngineTenantUnregisterPcapFile ( uint32_t tenant_id )

Definition at line 4582 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTenantUnregisterVlanId()

int DetectEngineTenantUnregisterVlanId	(	uint32_t	tenant_id,
		uint16_t	vlan_id
	)

Definition at line 4571 of file detect-engine.c.

◆ DetectEngineThreadCtxDeinit()

TmEcode DetectEngineThreadCtxDeinit	(	ThreadVars *	tv,
		void *	data
	)

Definition at line 3592 of file detect-engine.c.

References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SCLogWarning, and TM_ECODE_OK.

Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineThreadCtxInit()

TmEcode DetectEngineThreadCtxInit	(	ThreadVars *	tv,
		void *	initdata,
		void **	data
	)

initialize thread specific detection engine context

Note: there is a special case when using delayed detect. In this case the function is called twice per thread. The first time the rules are not yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd time they will be loaded. de_ctx->delayed_detect_initialized will be 1. This is needed to do the per thread counter registration before the packet runtime starts. In delayed detect mode, the first call will return a NULL ptr through the data ptr.

Parameters

tv	ThreadVars for this thread
initdata	pointer to de_ctx
data[out]	pointer to store our thread detection ctx

Return values

TM_ECODE_OK	if all went well
TM_ECODE_FAILED	on serious errors

alert counter setup

Definition at line 3365 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCCalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineThreadCtxInitForReload()

DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload	(	ThreadVars *	tv,
		DetectEngineCtx *	new_de_ctx,
		int	mt
	)

alert counter setup

Definition at line 3444 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineReference(), SCCalloc, SCFree, DetectEngineCtx_::tenant_id, DetectEngineThreadCtx_::tenant_id, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Here is the call graph for this function:

◆ DetectEngineUnsetParseMetadata()

void DetectEngineUnsetParseMetadata ( void )

Definition at line 4952 of file detect-engine.c.

◆ DetectPktInspectEngineRegister()

void DetectPktInspectEngineRegister	(	const char *	name,
		InspectionBufferGetPktDataPtr	GetPktData,
		InspectionBufferPktInspectFunc	Callback
	)

register inspect engine at start up time

Note: errors are fatal

Definition at line 130 of file detect-engine.c.

References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectRegisterThreadCtxFuncs()

int DetectRegisterThreadCtxFuncs	(	DetectEngineCtx *	de_ctx,
		const char *	name,
		void ()(void *)	InitFunc,
		void *	data,
		void()(void )	FreeFunc,
		int	mode
	)

Register Thread keyword context Funcs.

Parameters

de_ctx	detection engine to register in
name	keyword name for error printing
InitFunc	function ptr
data	keyword init data to pass to Func. Can be NULL.
FreeFunc	function ptr
mode	0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct)

Return values

id	for retrieval of ctx at runtime
-1	on error

Note: make sure "data" remains valid and it free'd elsewhere. It's recommended to store it in the keywords global ctx so that it's freed when the de_ctx is freed.

Definition at line 3649 of file detect-engine.c.

References BUG_ON, de_ctx, HashListTableInit(), and DetectEngineCtx_::keyword_hash.

Here is the call graph for this function:

◆ DetectRegisterThreadCtxGlobalFuncs()

int DetectRegisterThreadCtxGlobalFuncs	(	const char *	name,
		void ()(void *)	InitFunc,
		void *	data,
		void()(void )	FreeFunc
	)

Register Thread keyword context Funcs (Global)

IDs stay static over reloads and between tenants

Parameters

name	keyword name for error printing
InitFunc	function ptr
FreeFunc	function ptr

Return values

id	for retrieval of ctx at runtime
-1	on error

Definition at line 3739 of file detect-engine.c.

References BUG_ON.

◆ DetectSigmatchListEnumToString()

const char* DetectSigmatchListEnumToString ( enum DetectSigmatchListEnum type )

Definition at line 4962 of file detect-engine.c.

References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.

◆ DetectThreadCtxGetGlobalKeywordThreadCtx()

void* DetectThreadCtxGetGlobalKeywordThreadCtx	(	DetectEngineThreadCtx *	det_ctx,
		int	id
	)

Retrieve thread local keyword ctx by id.

Parameters

det_ctx	detection engine thread ctx to retrieve the ctx from
id	id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.

Return values

ctx	or NULL on error

Definition at line 3783 of file detect-engine.c.

References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.

Referenced by HttpHeaderGetBufferSpace().

Here is the caller graph for this function:

◆ DetectThreadCtxGetKeywordThreadCtx()

void* DetectThreadCtxGetKeywordThreadCtx	(	DetectEngineThreadCtx *	det_ctx,
		int	id
	)

Retrieve thread local keyword ctx by id.

Parameters

det_ctx	detection engine thread ctx to retrieve the ctx from
id	id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.

Return values

ctx	or NULL on error

Definition at line 3719 of file detect-engine.c.

References DetectEngineThreadCtx_::keyword_ctxs_array, and DetectEngineThreadCtx_::keyword_ctxs_size.

Referenced by DetectLuaMatchBuffer(), and DetectPcrePayloadMatch().

Here is the caller graph for this function:

◆ DetectUnregisterThreadCtxFuncs()

int DetectUnregisterThreadCtxFuncs	(	DetectEngineCtx *	de_ctx,
		void *	data,
		const char *	name
	)

Remove Thread keyword context registration.

Parameters

de_ctx	detection engine to deregister from
det_ctx	detection engine thread context to deregister from
data	keyword init data to pass to Func. Can be NULL.
name	keyword name for error printing

Return values

1	Item unregistered
0	otherwise

Note: make sure "data" remains valid and it free'd elsewhere. It's recommended to store it in the keywords global ctx so that it's freed when the de_ctx is freed.

Definition at line 3701 of file detect-engine.c.

References DetectEngineThreadKeywordCtxItem_::data, de_ctx, HashListTableRemove(), and DetectEngineCtx_::keyword_hash.

Here is the call graph for this function:

◆ InspectionBufferApplyTransforms()

void InspectionBufferApplyTransforms	(	InspectionBuffer *	buffer,
		const DetectEngineTransforms *	transforms
	)

Definition at line 1712 of file detect-engine.c.

References BUG_ON, DETECT_TRANSFORMS_MAX, TransformData_::options, SCLogDebug, sigmatch_table, TransformData_::transform, SigTableElmt_::Transform, and DetectEngineTransforms::transforms.

Referenced by DetectHelperGetData(), and InspectionBufferSetupMulti().

Here is the caller graph for this function:

◆ InspectionBufferCheckAndExpand()

void* InspectionBufferCheckAndExpand	(	InspectionBuffer *	buffer,
		uint32_t	min_size
	)

make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary

Definition at line 1627 of file detect-engine.c.

References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.

Referenced by FileSwfDecompression(), and InspectionBufferCopy().

Here is the caller graph for this function:

◆ InspectionBufferClean()

void InspectionBufferClean ( DetectEngineThreadCtx * det_ctx )

Definition at line 1473 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.

◆ InspectionBufferCopy()

void InspectionBufferCopy	(	InspectionBuffer *	buffer,
		uint8_t *	buf,
		uint32_t	buf_len
	)

Definition at line 1656 of file detect-engine.c.

References InspectionBuffer::buf, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.

Here is the call graph for this function:

◆ InspectionBufferFree()

void InspectionBufferFree ( InspectionBuffer * buffer )

Definition at line 1615 of file detect-engine.c.

References InspectionBuffer::buf, and SCFree.

◆ InspectionBufferGet()

InspectionBuffer* InspectionBufferGet	(	DetectEngineThreadCtx *	det_ctx,
		const int	list_id
	)

Definition at line 1501 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, and DetectEngineThreadCtx_::inspect.

Referenced by DetectHelperGetData(), and InspectionBufferSetup().

Here is the caller graph for this function:

◆ InspectionBufferInit()

void InspectionBufferInit	(	InspectionBuffer *	buffer,
		uint32_t	initial_size
	)

Definition at line 1558 of file detect-engine.c.

References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.

◆ InspectionBufferMultipleForListGet()

InspectionBuffer* InspectionBufferMultipleForListGet	(	DetectEngineThreadCtx *	det_ctx,
		const int	list_id,
		const uint32_t	local_id
	)

for a InspectionBufferMultipleForList get a InspectionBuffer

Parameters

fb	the multiple buffer array
local_id	the index to get a buffer
buffer	the inspect buffer or NULL in case of error

Definition at line 1521 of file detect-engine.c.

References DETECT_EVENT_TOO_MANY_BUFFERS, DetectEngineSetEvent(), and unlikely.

Referenced by DetectHelperGetMultiData().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ InspectionBufferSetup()

void InspectionBufferSetup	(	DetectEngineThreadCtx *	det_ctx,
		const int	list_id,
		InspectionBuffer *	buffer,
		const uint8_t *	data,
		const uint32_t	data_len
	)

setup the buffer with our initial data

Definition at line 1596 of file detect-engine.c.

References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBuffer::inspect_len, InspectionBufferGet(), InspectionBuffer::len, InspectionBuffer::orig, InspectionBuffer::orig_len, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.

Referenced by DetectHelperGetData().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ InspectionBufferSetupMulti()

void InspectionBufferSetupMulti	(	InspectionBuffer *	buffer,
		const DetectEngineTransforms *	transforms,
		const uint8_t *	data,
		const uint32_t	data_len
	)

setup the buffer with our initial data

Definition at line 1581 of file detect-engine.c.

References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferApplyTransforms(), InspectionBuffer::len, InspectionBuffer::orig, and InspectionBuffer::orig_len.

Referenced by DetectHelperGetMultiData().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ InspectionBufferSetupMultiEmpty()

void InspectionBufferSetupMultiEmpty ( InspectionBuffer * buffer )

setup the buffer empty

Definition at line 1568 of file detect-engine.c.

References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, and InspectionBuffer::len.

Referenced by DetectHelperGetMultiData().

Here is the caller graph for this function:

◆ InspectionBufferTruncate()

void InspectionBufferTruncate	(	InspectionBuffer *	buffer,
		uint32_t	buf_len
	)

Definition at line 1647 of file detect-engine.c.

References InspectionBuffer::buf, DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, and InspectionBuffer::size.

Variable Documentation

◆ signature_properties

const struct SignatureProperties signature_properties[SIG_TYPE_MAX]

Initial value:

= {
          { SIG_PROP_FLOW_ACTION_PACKET, },
           { SIG_PROP_FLOW_ACTION_FLOW, },
      { SIG_PROP_FLOW_ACTION_FLOW, },
           { SIG_PROP_FLOW_ACTION_FLOW, },
           { SIG_PROP_FLOW_ACTION_PACKET, },
              { SIG_PROP_FLOW_ACTION_PACKET, },
       { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
           { SIG_PROP_FLOW_ACTION_FLOW_IF_STATEFUL, },
         { SIG_PROP_FLOW_ACTION_FLOW, },
           { SIG_PROP_FLOW_ACTION_FLOW, },
}

Definition at line 110 of file detect-engine.c.

Data Structures

Macros

Typedefs

Enumerations

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT

Typedef Documentation

◆ DetectEngineSyncer

◆ TenantLoaderCtx

Enumeration Type Documentation

◆ DetectEngineSyncState

Function Documentation

◆ DetectAppLayerInspectEngineRegister()

◆ DetectAppLayerMultiRegister()

◆ DetectBufferGetActiveList()

◆ DetectBufferGetFirstSigMatch()

◆ DetectBufferGetLastSigMatch()

◆ DetectBufferIsPresent()

◆ DetectBufferSetActiveList()

◆ DetectBufferTypeCloseRegistration()

◆ DetectBufferTypeGetByName()

◆ DetectBufferTypeGetDescriptionByName()

◆ DetectBufferTypeMaxId()

◆ DetectBufferTypeRegister()

◆ DetectBufferTypeRegisterSetupCallback()

◆ DetectBufferTypeRegisterValidateCallback()

◆ DetectBufferTypeSetDescriptionByName()

◆ DetectBufferTypeSupportsFrames()

◆ DetectBufferTypeSupportsMpm()

◆ DetectBufferTypeSupportsMultiInstance()

◆ DetectBufferTypeSupportsPacket()

◆ DetectBufferTypeSupportsTransformations()

◆ DetectEngineAddToMaster()

◆ DetectEngineAppInspectionEngine2Signature()

◆ DetectEngineAppInspectionEngineSignatureFree()

◆ DetectEngineBufferRunSetupCallback()

◆ DetectEngineBufferRunValidateCallback()

◆ DetectEngineBufferTypeGetById()

◆ DetectEngineBufferTypeGetByIdTransforms()

◆ DetectEngineBufferTypeGetDescriptionById()

◆ DetectEngineBufferTypeGetNameById()

◆ DetectEngineBufferTypeRegister()

◆ DetectEngineBufferTypeRegisterWithFrameEngines()

◆ DetectEngineBufferTypeSupportsFrames()

◆ DetectEngineBufferTypeSupportsFramesGetById()

◆ DetectEngineBufferTypeSupportsMpm()

◆ DetectEngineBufferTypeSupportsMpmGetById()

◆ DetectEngineBufferTypeSupportsMultiInstanceGetById()

◆ DetectEngineBufferTypeSupportsPacket()

◆ DetectEngineBufferTypeSupportsPacketGetById()

◆ DetectEngineBufferTypeSupportsTransformations()

◆ DetectEngineBufferTypeValidateTransform()

◆ DetectEngineBumpVersion()

◆ DetectEngineClearMaster()

◆ DetectEngineCtxFree()

◆ DetectEngineCtxInit()

◆ DetectEngineCtxInitStubForDD()

◆ DetectEngineCtxInitStubForMT()

◆ DetectEngineCtxInitWithPrefix()

◆ DetectEngineDeReference()

◆ DetectEngineEnabled()

◆ DetectEngineFrameInspectEngineRegister()

◆ DetectEngineGetByTenantId()

◆ DetectEngineGetCurrent()

◆ DetectEngineGetVersion()

◆ DetectEngineInspectBufferGeneric()

◆ DetectEngineInspectGenericList()

◆ DetectEngineInspectMultiBufferGeneric()

◆ DetectEngineInspectPktBufferGeneric()

◆ DetectEngineLoadTenantBlocking()

◆ DetectEngineMoveToFreeList()

◆ DetectEngineMTApply()

◆ DetectEngineMultiTenantEnabled()

◆ DetectEngineMultiTenantSetup()

◆ DetectEngineMustParseMetadata()

◆ DetectEnginePktInspectionRun()

◆ DetectEnginePktInspectionSetup()