suricata
|
#include "suricata-common.h"
#include "suricata.h"
#include "detect.h"
#include "flow.h"
#include "flow-private.h"
#include "flow-util.h"
#include "flow-worker.h"
#include "conf.h"
#include "conf-yaml-loader.h"
#include "datasets.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-tag.h"
#include "detect-engine-frame.h"
#include "detect-engine-file.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
#include "detect-fast-pattern.h"
#include "detect-byte-extract.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-tcphdr.h"
#include "detect-engine-threshold.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-loader.h"
#include "util-classification-config.h"
#include "util-reference-config.h"
#include "util-threshold-config.h"
#include "util-error.h"
#include "util-hash.h"
#include "util-byte.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-action.h"
#include "util-magic.h"
#include "util-signal.h"
#include "util-spm.h"
#include "util-device.h"
#include "util-var-name.h"
#include "util-path.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-hash-string.h"
#include "util-enum.h"
#include "util-conf.h"
#include "tm-threads.h"
#include "runmodes.h"
#include "reputation.h"
#include "util-hash-lookup3.h"
Go to the source code of this file.
Data Structures | |
struct | DetectEngineSyncer_ |
struct | TenantLoaderCtx_ |
Macros | |
#define | DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000 |
Typedefs | |
typedef struct DetectEngineSyncer_ | DetectEngineSyncer |
typedef struct TenantLoaderCtx_ | TenantLoaderCtx |
Enumerations | |
enum | DetectEngineSyncState { IDLE, RELOAD } |
Variables | |
const struct SignatureProperties | signature_properties [SIG_TYPE_MAX] |
Definition in file detect-engine.c.
#define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000 |
Definition at line 93 of file detect-engine.c.
typedef struct DetectEngineSyncer_ DetectEngineSyncer |
typedef struct TenantLoaderCtx_ TenantLoaderCtx |
Enumerator | |
---|---|
IDLE | ready to start a reload |
RELOAD | command main thread to do the reload |
Definition at line 2025 of file detect-engine.c.
void DetectAppLayerInspectEngineRegister | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectEngineFuncPtr | Callback2, | ||
InspectionBufferGetDataPtr | GetData | ||
) |
Registers an app inspection engine.
name | Name of the detection list |
alproto | App layer protocol for which we will register the engine. |
direction | The direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT |
progress | Minimal progress value for inspect engine to run |
Callback | The engine callback. |
Definition at line 238 of file detect-engine.c.
Referenced by DetectFileRegisterFileProtocols(), and DetectHelperBufferRegister().
void DetectAppLayerMultiRegister | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectionMultiBufferGetDataPtr | GetData, | ||
int | priority, | ||
int | tx_min_progress | ||
) |
Definition at line 2187 of file detect-engine.c.
int DetectBufferGetActiveList | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 1422 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, BUG_ON, DetectEngineTransforms::cnt, SignatureInitData_::curbuf, de_ctx, DEBUG_VALIDATE_BUG_ON, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_NOTSET, DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeSupportsMultiInstanceGetById(), SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::init_data, SignatureInitData_::list, SignatureInitData_::list_set, SignatureInitDataBuffer_::multi_capable, SCLogDebug, SCLogError, SCReturnInt, SignatureInitDataBufferCheckExpand(), DetectEngineTransforms::transforms, and SignatureInitData_::transforms.
Referenced by DetectContentSetup().
Definition at line 1323 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, and Signature_::init_data.
Definition at line 1333 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, Signature_::init_data, and SignatureInitDataBuffer_::tail.
bool DetectBufferIsPresent | ( | const Signature * | s, |
const uint32_t | buf_id | ||
) |
Definition at line 1344 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, and Signature_::init_data.
int DetectBufferSetActiveList | ( | DetectEngineCtx * | de_ctx, |
Signature * | s, | ||
const int | list | ||
) |
Definition at line 1354 of file detect-engine.c.
void DetectBufferTypeCloseRegistration | ( | void | ) |
Definition at line 1803 of file detect-engine.c.
References BUG_ON.
int DetectBufferTypeGetByName | ( | const char * | name | ) |
Definition at line 1091 of file detect-engine.c.
Referenced by DetectEngineAppInspectionEngine2Signature(), DetectFrameMpmRegister(), and DetectPktInspectEngineRegister().
const char* DetectBufferTypeGetDescriptionByName | ( | const char * | name | ) |
Definition at line 1208 of file detect-engine.c.
int DetectBufferTypeMaxId | ( | void | ) |
Definition at line 919 of file detect-engine.c.
int DetectBufferTypeRegister | ( | const char * | name | ) |
Definition at line 1027 of file detect-engine.c.
References BUG_ON.
Referenced by DetectHelperBufferRegister(), and DetectPktInspectEngineRegister().
void DetectBufferTypeRegisterSetupCallback | ( | const char * | name, |
void(*)(const DetectEngineCtx *, Signature *) | SetupCallback | ||
) |
Definition at line 1285 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeRegisterValidateCallback | ( | const char * | name, |
bool(*)(const Signature *, const char **sigerror) | ValidateCallback | ||
) |
Definition at line 1303 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSetDescriptionByName | ( | const char * | name, |
const char * | desc | ||
) |
Definition at line 1188 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsFrames | ( | const char * | name | ) |
Definition at line 1051 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsMpm | ( | const char * | name | ) |
Definition at line 1071 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsMultiInstance | ( | const char * | name | ) |
Definition at line 1041 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsPacket | ( | const char * | name | ) |
Definition at line 1061 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsTransformations | ( | const char * | name | ) |
Definition at line 1081 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
int DetectEngineAddToMaster | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4587 of file detect-engine.c.
References de_ctx, and SCLogDebug.
int DetectEngineAppInspectionEngine2Signature | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 726 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, de_ctx, DE_STATE_FLAG_BASE, DetectBufferTypeGetByName(), DetectEngineBufferTypeGetById(), FatalError, DetectBufferType_::frame, DetectEngineCtx_::frame_inspect_engines, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, DetectEngineFrameInspectionEngine::next, SCLogDebug, SigMatchList2DataArray(), and DetectEngineFrameInspectionEngine::sm_list.
void DetectEngineAppInspectionEngineSignatureFree | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
free app inspect engines for a signature
For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.
Definition at line 813 of file detect-engine.c.
References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.
void DetectEngineBufferRunSetupCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
Signature * | s | ||
) |
Definition at line 1295 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.
bool DetectEngineBufferRunValidateCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
const Signature * | s, | ||
const char ** | sigerror | ||
) |
Definition at line 1313 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::ValidateCallback.
const DetectBufferType * DetectEngineBufferTypeGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1111 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_hash_id, de_ctx, HashListTableLookup(), and DetectBufferType_::id.
Referenced by DetectEngineAppInspectionEngine2Signature(), DetectEngineBufferRunSetupCallback(), DetectEngineBufferRunValidateCallback(), DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeGetDescriptionById(), DetectEngineBufferTypeGetNameById(), DetectEngineBufferTypeSupportsFramesGetById(), DetectEngineBufferTypeSupportsMpmGetById(), DetectEngineBufferTypeSupportsMultiInstanceGetById(), DetectEngineBufferTypeSupportsPacketGetById(), and DetectEngineBufferTypeValidateTransform().
int DetectEngineBufferTypeGetByIdTransforms | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
TransformData * | transforms, | ||
int | transform_cnt | ||
) |
Definition at line 1810 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_hash_id, DetectEngineCtx_::buffer_type_hash_name, DetectEngineCtx_::buffer_type_id, BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectAppLayerMpmRegisterByParentId(), DetectEngineBufferTypeGetById(), DetectFrameMpmRegisterByParentId(), DetectPktMpmRegisterByParentId(), DetectBufferType_::frame, HashListTableAdd(), HashListTableLookup(), DetectBufferType_::id, DetectBufferType_::mpm, DetectBufferType_::name, DetectBufferType_::packet, DetectBufferType_::parent_id, SCCalloc, SCLogDebug, SCLogError, DetectBufferType_::SetupCallback, strlcpy(), DetectBufferType_::supports_transforms, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and DetectBufferType_::ValidateCallback.
Referenced by DetectBufferGetActiveList().
const char* DetectEngineBufferTypeGetDescriptionById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1199 of file detect-engine.c.
References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().
Referenced by EngineAnalysisFP().
const char* DetectEngineBufferTypeGetNameById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1121 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.
Referenced by DumpPatterns(), EngineAnalysisFP(), and EngineAnalysisRules2().
int DetectEngineBufferTypeRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1178 of file detect-engine.c.
Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().
int DetectEngineBufferTypeRegisterWithFrameEngines | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
const int | direction, | ||
const AppProto | alproto, | ||
const uint8_t | frame_type | ||
) |
Definition at line 1144 of file detect-engine.c.
void DetectEngineBufferTypeSupportsFrames | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1217 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeSupportsFramesGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1276 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::frame, and SCLogDebug.
void DetectEngineBufferTypeSupportsMpm | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1233 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeSupportsMpmGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1267 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.
Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().
bool DetectEngineBufferTypeSupportsMultiInstanceGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1249 of file detect-engine.c.
References BOOL2STR, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::multi_instance, and SCLogDebug.
Referenced by DetectBufferGetActiveList().
void DetectEngineBufferTypeSupportsPacket | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1225 of file detect-engine.c.
bool DetectEngineBufferTypeSupportsPacketGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1258 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.
void DetectEngineBufferTypeSupportsTransformations | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1241 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeValidateTransform | ( | DetectEngineCtx * | de_ctx, |
int | sm_list, | ||
const uint8_t * | content, | ||
uint16_t | content_len, | ||
const char ** | namestr | ||
) |
Check content byte array compatibility with transforms.
The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.
When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first validation failure terminates the loop.
de_ctx | Detection engine context. |
sm_list | The SM list id. |
content | The byte array being validated |
namestr | returns the name of the transform that is incompatible with content. |
true | (false) If any of the transforms indicate the byte array is (is not) compatible. |
Definition at line 1672 of file detect-engine.c.
References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.
Referenced by DetectContentSetup().
void DetectEngineBumpVersion | ( | void | ) |
Definition at line 3766 of file detect-engine.c.
void DetectEngineClearMaster | ( | void | ) |
Definition at line 4687 of file detect-engine.c.
Referenced by GlobalsDestroy().
void DetectEngineCtxFree | ( | DetectEngineCtx * | de_ctx | ) |
Free a DetectEngineCtx::
de_ctx | DetectEngineCtx:: to be freed |
Definition at line 2597 of file detect-engine.c.
References de_ctx, DetectEngineFreeFastPatternList(), DetectParseDupSigHashFree(), DetectEngineCtx_::filedata_config, MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingRuleDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::sm_types_prefilter, DetectEngineCtx_::sm_types_silent_error, DetectEngineCtx_::spm_global_thread_ctx, and SpmDestroyGlobalThreadCtx().
Referenced by LLVMFuzzerTestOneInput(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().
DetectEngineCtx* DetectEngineCtxInit | ( | void | ) |
Definition at line 2558 of file detect-engine.c.
Referenced by DetectEngineCtxInitWithPrefix(), LLVMFuzzerTestOneInput(), UTHGenericTest(), UTHPacketMatchSig(), UTHPacketMatchSigMpm(), and UTHParseSignature().
DetectEngineCtx* DetectEngineCtxInitStubForDD | ( | void | ) |
Definition at line 2553 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitStubForMT | ( | void | ) |
Definition at line 2548 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitWithPrefix | ( | const char * | prefix, |
uint32_t | tenant_id | ||
) |
Definition at line 2563 of file detect-engine.c.
References DetectEngineCtxInit().
void DetectEngineDeReference | ( | DetectEngineCtx ** | de_ctx | ) |
Definition at line 4563 of file detect-engine.c.
References BUG_ON, and de_ctx.
Referenced by GlobalsDestroy().
int DetectEngineEnabled | ( | void | ) |
Check if detection is enabled.
bool | true or false |
Definition at line 3742 of file detect-engine.c.
void DetectEngineFrameInspectEngineRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
int | dir, | ||
InspectionBufferFrameInspectFunc | Callback, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
register inspect engine at start up time
Definition at line 377 of file detect-engine.c.
References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, de_ctx, DETECT_SM_LIST_MATCH, DetectEngineBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, DetectEngineCtx_::frame_inspect_engines, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.
DetectEngineCtx* DetectEngineGetByTenantId | ( | uint32_t | tenant_id | ) |
Definition at line 4537 of file detect-engine.c.
DetectEngineCtx* DetectEngineGetCurrent | ( | void | ) |
Definition at line 3775 of file detect-engine.c.
Referenced by DetectEngineThreadCtxInit(), and GlobalsDestroy().
uint32_t DetectEngineGetVersion | ( | void | ) |
Definition at line 3756 of file detect-engine.c.
References version.
uint8_t DetectEngineInspectBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match. |
1 | match. |
2 | Sig can't match. |
Definition at line 2140 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.
uint8_t DetectEngineInspectGenericList | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const struct DetectEngineAppInspectionEngine_ * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
sm | SigMatch to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match |
1 | match |
Definition at line 2097 of file detect-engine.c.
References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.
Referenced by DetectHelperBufferRegister().
uint8_t DetectEngineInspectMultiBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Definition at line 2196 of file detect-engine.c.
References de_ctx, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspectionBuffer(), flags, DetectEngineAppInspectionEngine_::GetMultiData, InspectionBuffer::inspect, DetectEngineAppInspectionEngine_::mpm, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, and DetectEngineAppInspectionEngine_::v2.
int DetectEngineInspectPktBufferGeneric | ( | DetectEngineThreadCtx * | det_ctx, |
const DetectEnginePktInspectionEngine * | engine, | ||
const Signature * | s, | ||
Packet * | p, | ||
uint8_t * | _alert_flags | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
p | Packet |
0 | no match. |
1 | match. |
Definition at line 2236 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEnginePktInspectionEngine::mpm, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectEngineLoadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml | ||
) |
Load a tenant and wait for loading to complete.
Definition at line 4061 of file detect-engine.c.
int DetectEngineMoveToFreeList | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4647 of file detect-engine.c.
Referenced by GlobalsDestroy().
int DetectEngineMTApply | ( | void | ) |
Definition at line 4834 of file detect-engine.c.
int DetectEngineMultiTenantEnabled | ( | void | ) |
TODO locking? Not needed if this is a one time setting at startup
Definition at line 3807 of file detect-engine.c.
int DetectEngineMultiTenantSetup | ( | const bool | unix_socket | ) |
setup multi-detect / multi-tenancy
See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.
Definition at line 4224 of file detect-engine.c.
References TENANT_SELECTOR_UNKNOWN.
int DetectEngineMustParseMetadata | ( | void | ) |
Definition at line 4901 of file detect-engine.c.
Referenced by DetectMetadataHashInit().
bool DetectEnginePktInspectionRun | ( | ThreadVars * | tv, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p, | ||
uint8_t * | alert_flags | ||
) |
Definition at line 1955 of file detect-engine.c.
References DetectEnginePktInspectionEngine::Callback, DETECT_ENGINE_INSPECT_SIG_MATCH, Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, SCLogDebug, and DetectEnginePktInspectionEngine::v1.
int DetectEnginePktInspectionSetup | ( | Signature * | s | ) |
Definition at line 2003 of file detect-engine.c.
References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.
void DetectEnginePruneFreeList | ( | void | ) |
Definition at line 4657 of file detect-engine.c.
DetectEngineCtx* DetectEngineReference | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 3798 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::ref_cnt.
Referenced by DetectEngineThreadCtxInitForReload().
void DetectEngineRegisterTests | ( | void | ) |
Definition at line 5143 of file detect-engine.c.
References UtRegisterTest().
int DetectEngineReload | ( | const SCInstance * | suri | ) |
Reload the detection engine.
filename | YAML file to load for the detect config |
-1 | error |
0 | ok |
Definition at line 4714 of file detect-engine.c.
References SCInstance_::conf_filename, and SCLogNotice.
Referenced by SuricataMainLoop().
int DetectEngineReloadIsIdle | ( | void | ) |
Definition at line 2073 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadIsStart | ( | void | ) |
Definition at line 2053 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
void DetectEngineReloadSetIdle | ( | void | ) |
Definition at line 2065 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
int DetectEngineReloadStart | ( | void | ) |
Definition at line 2039 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
int DetectEngineReloadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml, | ||
int | reload_cnt | ||
) |
Reload a tenant and wait for loading to complete.
Definition at line 4075 of file detect-engine.c.
int DetectEngineReloadTenantsBlocking | ( | const int | reload_cnt | ) |
Reload all tenants and wait for loading to complete.
Definition at line 4089 of file detect-engine.c.
void DetectEngineResetMaxSigId | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 2990 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::signum.
Referenced by SigCleanSignatures().
void DetectEngineSetEvent | ( | DetectEngineThreadCtx * | det_ctx, |
uint8_t | e | ||
) |
Definition at line 4935 of file detect-engine.c.
References AppLayerDecoderEventsSetEventRaw(), DetectEngineThreadCtx_::decoder_events, and DetectEngineThreadCtx_::events.
Referenced by FileSwfDecompression(), FileSwfLzmaDecompression(), FileSwfZlibDecompression(), and InspectionBufferMultipleForListGet().
void DetectEngineSetParseMetadata | ( | void | ) |
Definition at line 4891 of file detect-engine.c.
int DetectEngineTenantRegisterLivedev | ( | uint32_t | tenant_id, |
int | device_id | ||
) |
Definition at line 4504 of file detect-engine.c.
int DetectEngineTenantRegisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4520 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTenantRegisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4510 of file detect-engine.c.
int DetectEngineTenantUnregisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4526 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTenantUnregisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4515 of file detect-engine.c.
TmEcode DetectEngineThreadCtxDeinit | ( | ThreadVars * | tv, |
void * | data | ||
) |
Definition at line 3539 of file detect-engine.c.
References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SCLogWarning, and TM_ECODE_OK.
Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
TmEcode DetectEngineThreadCtxInit | ( | ThreadVars * | tv, |
void * | initdata, | ||
void ** | data | ||
) |
initialize thread specific detection engine context
tv | ThreadVars for this thread |
initdata | pointer to de_ctx |
data[out] | pointer to store our thread detection ctx |
TM_ECODE_OK | if all went well |
TM_ECODE_FAILED | on serious errors |
alert counter setup
Definition at line 3312 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCCalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload | ( | ThreadVars * | tv, |
DetectEngineCtx * | new_de_ctx, | ||
int | mt | ||
) |
alert counter setup
Definition at line 3391 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineReference(), SCCalloc, SCFree, DetectEngineCtx_::tenant_id, DetectEngineThreadCtx_::tenant_id, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
void DetectEngineUnsetParseMetadata | ( | void | ) |
Definition at line 4896 of file detect-engine.c.
void DetectPktInspectEngineRegister | ( | const char * | name, |
InspectionBufferGetPktDataPtr | GetPktData, | ||
InspectionBufferPktInspectFunc | Callback | ||
) |
register inspect engine at start up time
Definition at line 128 of file detect-engine.c.
References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectRegisterThreadCtxFuncs | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc, | ||
int | mode | ||
) |
Register Thread keyword context Funcs.
de_ctx | detection engine to register in |
name | keyword name for error printing |
InitFunc | function ptr |
data | keyword init data to pass to Func. Can be NULL. |
FreeFunc | function ptr |
mode | 0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct) |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 3596 of file detect-engine.c.
References BUG_ON, de_ctx, HashListTableInit(), and DetectEngineCtx_::keyword_hash.
int DetectRegisterThreadCtxGlobalFuncs | ( | const char * | name, |
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc | ||
) |
Register Thread keyword context Funcs (Global)
IDs stay static over reloads and between tenants
name | keyword name for error printing |
InitFunc | function ptr |
FreeFunc | function ptr |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 3686 of file detect-engine.c.
References BUG_ON.
const char* DetectSigmatchListEnumToString | ( | enum DetectSigmatchListEnum | type | ) |
Definition at line 4906 of file detect-engine.c.
References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.
void* DetectThreadCtxGetGlobalKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3730 of file detect-engine.c.
References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.
Referenced by HttpHeaderGetBufferSpace().
void* DetectThreadCtxGetKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3666 of file detect-engine.c.
References DetectEngineThreadCtx_::keyword_ctxs_array, and DetectEngineThreadCtx_::keyword_ctxs_size.
Referenced by DetectLuaMatchBuffer(), and DetectPcrePayloadMatch().
int DetectUnregisterThreadCtxFuncs | ( | DetectEngineCtx * | de_ctx, |
void * | data, | ||
const char * | name | ||
) |
Remove Thread keyword context registration.
de_ctx | detection engine to deregister from |
det_ctx | detection engine thread context to deregister from |
data | keyword init data to pass to Func. Can be NULL. |
name | keyword name for error printing |
1 | Item unregistered |
0 | otherwise |
Definition at line 3648 of file detect-engine.c.
References DetectEngineThreadKeywordCtxItem_::data, de_ctx, HashListTableRemove(), and DetectEngineCtx_::keyword_hash.
void InspectionBufferApplyTransforms | ( | InspectionBuffer * | buffer, |
const DetectEngineTransforms * | transforms | ||
) |
Definition at line 1697 of file detect-engine.c.
References BUG_ON, DETECT_TRANSFORMS_MAX, TransformData_::options, SCLogDebug, sigmatch_table, TransformData_::transform, SigTableElmt_::Transform, and DetectEngineTransforms::transforms.
Referenced by DetectHelperGetData(), and InspectionBufferSetupMulti().
void InspectionBufferCheckAndExpand | ( | InspectionBuffer * | buffer, |
uint32_t | min_size | ||
) |
make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary
Definition at line 1624 of file detect-engine.c.
References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.
Referenced by FileSwfDecompression(), and InspectionBufferCopy().
void InspectionBufferClean | ( | DetectEngineThreadCtx * | det_ctx | ) |
Definition at line 1470 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
void InspectionBufferCopy | ( | InspectionBuffer * | buffer, |
uint8_t * | buf, | ||
uint32_t | buf_len | ||
) |
Definition at line 1641 of file detect-engine.c.
References InspectionBuffer::buf, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.
void InspectionBufferFree | ( | InspectionBuffer * | buffer | ) |
Definition at line 1612 of file detect-engine.c.
References InspectionBuffer::buf, and SCFree.
InspectionBuffer* InspectionBufferGet | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id | ||
) |
Definition at line 1498 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, and DetectEngineThreadCtx_::inspect.
Referenced by DetectHelperGetData(), and InspectionBufferSetup().
void InspectionBufferInit | ( | InspectionBuffer * | buffer, |
uint32_t | initial_size | ||
) |
Definition at line 1555 of file detect-engine.c.
References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.
InspectionBuffer* InspectionBufferMultipleForListGet | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id, | ||
const uint32_t | local_id | ||
) |
for a InspectionBufferMultipleForList get a InspectionBuffer
fb | the multiple buffer array |
local_id | the index to get a buffer |
buffer | the inspect buffer or NULL in case of error |
Definition at line 1518 of file detect-engine.c.
References DETECT_EVENT_TOO_MANY_BUFFERS, DetectEngineSetEvent(), and unlikely.
Referenced by DetectHelperGetMultiData().
void InspectionBufferSetup | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id, | ||
InspectionBuffer * | buffer, | ||
const uint8_t * | data, | ||
const uint32_t | data_len | ||
) |
setup the buffer with our initial data
Definition at line 1593 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBuffer::inspect_len, InspectionBufferGet(), InspectionBuffer::len, InspectionBuffer::orig, InspectionBuffer::orig_len, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
Referenced by DetectHelperGetData().
void InspectionBufferSetupMulti | ( | InspectionBuffer * | buffer, |
const DetectEngineTransforms * | transforms, | ||
const uint8_t * | data, | ||
const uint32_t | data_len | ||
) |
setup the buffer with our initial data
Definition at line 1578 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferApplyTransforms(), InspectionBuffer::len, InspectionBuffer::orig, and InspectionBuffer::orig_len.
Referenced by DetectHelperGetMultiData().
void InspectionBufferSetupMultiEmpty | ( | InspectionBuffer * | buffer | ) |
setup the buffer empty
Definition at line 1565 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, and InspectionBuffer::len.
Referenced by DetectHelperGetMultiData().
const struct SignatureProperties signature_properties[SIG_TYPE_MAX] |
Definition at line 108 of file detect-engine.c.