#include "detect.h"
#include "tm-threads.h"
#include "flow-private.h"

Include dependency graph for detect-engine.h:

Macros
#define	DetectEngineGetMaxSigId(de_ctx) ((de_ctx)->signum)

Functions
void	InspectionBufferInit (InspectionBuffer *buffer, uint32_t initial_size)

void	InspectionBufferSetup (InspectionBuffer buffer, const uint8_t data, const uint32_t data_len)
	setup the buffer with our initial data More...

void	InspectionBufferFree (InspectionBuffer *buffer)

void	InspectionBufferCheckAndExpand (InspectionBuffer *buffer, uint32_t min_size)
	make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary More...

void	InspectionBufferCopy (InspectionBuffer buffer, uint8_t buf, uint32_t buf_len)

void	InspectionBufferApplyTransforms (InspectionBuffer buffer, const DetectEngineTransforms transforms)

void	InspectionBufferClean (DetectEngineThreadCtx *det_ctx)

InspectionBuffer *	InspectionBufferGet (DetectEngineThreadCtx *det_ctx, const int list_id)

InspectionBuffer *	InspectionBufferMultipleForListGet (InspectionBufferMultipleForList *fb, uint32_t local_id)
	for a InspectionBufferMultipleForList get a InspectionBuffer More...

InspectionBufferMultipleForList *	InspectionBufferGetMulti (DetectEngineThreadCtx *det_ctx, const int list_id)

int	DetectBufferTypeRegister (const char *name)

int	DetectBufferTypeGetByName (const char *name)

void	DetectBufferTypeSupportsMpm (const char *name)

void	DetectBufferTypeSupportsPacket (const char *name)

void	DetectBufferTypeSupportsTransformations (const char *name)

int	DetectBufferTypeMaxId (void)

void	DetectBufferTypeCloseRegistration (void)

void	DetectBufferTypeSetDescriptionByName (const char name, const char desc)

const char *	DetectBufferTypeGetDescriptionByName (const char *name)

void	DetectBufferTypeRegisterSetupCallback (const char name, void(Callback)(const DetectEngineCtx , Signature ))

void	DetectBufferTypeRegisterValidateCallback (const char name, bool(ValidateCallback)(const Signature , const char *sigerror))

int	DetectBufferTypeGetByIdTransforms (DetectEngineCtx de_ctx, const int id, int transforms, int transform_cnt)

const char *	DetectBufferTypeGetNameById (const DetectEngineCtx *de_ctx, const int id)

bool	DetectBufferTypeSupportsMpmGetById (const DetectEngineCtx *de_ctx, const int id)

bool	DetectBufferTypeSupportsPacketGetById (const DetectEngineCtx *de_ctx, const int id)

const char *	DetectBufferTypeGetDescriptionById (const DetectEngineCtx *de_ctx, const int id)

void	DetectBufferRunSetupCallback (const DetectEngineCtx de_ctx, const int id, Signature s)

bool	DetectBufferRunValidateCallback (const DetectEngineCtx de_ctx, const int id, const Signature s, const char **sigerror)

DetectEngineCtx *	DetectEngineCtxInitWithPrefix (const char *prefix)

DetectEngineCtx *	DetectEngineCtxInit (void)

DetectEngineCtx *	DetectEngineCtxInitStubForDD (void)

DetectEngineCtx *	DetectEngineCtxInitStubForMT (void)

void	DetectEngineCtxFree (DetectEngineCtx *)
	Free a DetectEngineCtx:: More...

int	DetectRegisterThreadCtxGlobalFuncs (const char name, void (InitFunc)(void ), void data, void(FreeFunc)(void *))
	Register Thread keyword context Funcs (Global) More...

void *	DetectThreadCtxGetGlobalKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
	Retrieve thread local keyword ctx by id. More...

TmEcode	DetectEngineThreadCtxInit (ThreadVars , void , void **)
	initialize thread specific detection engine context More...

TmEcode	DetectEngineThreadCtxDeinit (ThreadVars , void )

void	DetectEngineResetMaxSigId (DetectEngineCtx *)

void	DetectEngineRegisterTests (void)

const char *	DetectSigmatchListEnumToString (enum DetectSigmatchListEnum type)

uint32_t	DetectEngineGetVersion (void)

void	DetectEngineBumpVersion (void)

int	DetectEngineAddToMaster (DetectEngineCtx *de_ctx)

DetectEngineCtx *	DetectEngineGetCurrent (void)

DetectEngineCtx *	DetectEngineGetByTenantId (int tenant_id)

void	DetectEnginePruneFreeList (void)

int	DetectEngineMoveToFreeList (DetectEngineCtx *de_ctx)

DetectEngineCtx *	DetectEngineReference (DetectEngineCtx *)

void	DetectEngineDeReference (DetectEngineCtx **de_ctx)

int	DetectEngineReload (const SCInstance *suri)
	Reload the detection engine. More...

int	DetectEngineEnabled (void)
	Check if detection is enabled. More...

int	DetectEngineMTApply (void)

int	DetectEngineMultiTenantEnabled (void)

int	DetectEngineMultiTenantSetup (void)
	setup multi-detect / multi-tenancy More...

int	DetectEngineReloadStart (void)

int	DetectEngineReloadIsStart (void)

void	DetectEngineReloadSetIdle (void)

int	DetectEngineReloadIsIdle (void)

int	DetectEngineLoadTenantBlocking (uint32_t tenant_id, const char *yaml)
	Load a tenant and wait for loading to complete. More...

int	DetectEngineReloadTenantBlocking (uint32_t tenant_id, const char *yaml, int reload_cnt)
	Reload a tenant and wait for loading to complete. More...

int	DetectEngineTentantRegisterLivedev (uint32_t tenant_id, int device_id)

int	DetectEngineTentantRegisterVlanId (uint32_t tenant_id, uint16_t vlan_id)

int	DetectEngineTentantUnregisterVlanId (uint32_t tenant_id, uint16_t vlan_id)

int	DetectEngineTentantRegisterPcapFile (uint32_t tenant_id)

int	DetectEngineTentantUnregisterPcapFile (uint32_t tenant_id)

int	DetectEngineInspectGenericList (ThreadVars , const DetectEngineCtx , DetectEngineThreadCtx , const Signature , const SigMatchData , Flow , const uint8_t, void , void , uint64_t)
	Do the content inspection & validation for a signature. More...

int	DetectEngineInspectBufferGeneric (DetectEngineCtx de_ctx, DetectEngineThreadCtx det_ctx, const DetectEngineAppInspectionEngine engine, const Signature s, Flow f, uint8_t flags, void alstate, void *txv, uint64_t tx_id)
	Do the content inspection & validation for a signature. More...

int	DetectEngineInspectPktBufferGeneric (DetectEngineThreadCtx det_ctx, const DetectEnginePktInspectionEngine engine, const Signature s, Packet p, uint8_t *alert_flags)
	Do the content inspection & validation for a signature. More...

void	DetectAppLayerInspectEngineRegister (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback)
	Registers an app inspection engine. More...

void	DetectAppLayerInspectEngineRegister2 (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr2 Callback2, InspectionBufferGetDataPtr GetData)
	register inspect engine at start up time More...

void	DetectPktInspectEngineRegister (const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
	register inspect engine at start up time More...

int	DetectEngineAppInspectionEngine2Signature (DetectEngineCtx de_ctx, Signature s)

void	DetectEngineAppInspectionEngineSignatureFree (Signature *s)
	free app inspect engines for a signature More...

bool	DetectEnginePktInspectionRun (ThreadVars tv, DetectEngineThreadCtx det_ctx, const Signature s, Flow f, Packet p, uint8_t alert_flags)

int	DetectEnginePktInspectionSetup (Signature *s)

void	DetectEngineSetParseMetadata (void)

void	DetectEngineUnsetParseMetadata (void)

int	DetectEngineMustParseMetadata (void)

int WARN_UNUSED	DetectBufferSetActiveList (Signature *s, const int list)

int	DetectBufferGetActiveList (DetectEngineCtx de_ctx, Signature s)

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file detect-engine.h.

Macro Definition Documentation

◆ DetectEngineGetMaxSigId

#define DetectEngineGetMaxSigId ( de_ctx ) ((de_ctx)->signum)

Definition at line 81 of file detect-engine.h.

Function Documentation

◆ DetectAppLayerInspectEngineRegister()

void DetectAppLayerInspectEngineRegister	(	const char *	name,
		AppProto	alproto,
		uint32_t	dir,
		int	progress,
		InspectEngineFuncPtr	Callback
	)

Registers an app inspection engine.

Parameters

name	Name of the detection list
alproto	App layer protocol for which we will register the engine.
direction	The direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
progress	Minimal progress value for inspect engine to run
Callback	The engine callback.

Registers an app inspection engine.

Note: errors are fatal

Definition at line 170 of file detect-engine.c.

References DetectEngineAppInspectionEngine_::alproto, ALPROTO_FAILED, AppLayerParserIsEnabled(), AppLayerParserSupportsTxDetectFlags(), AppProtoToString(), BUG_ON, DetectEngineAppInspectionEngine_::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), DetectEngineAppInspectionEngine_::dir, FatalError, DetectEngineAppInspectionEngine_::progress, SC_ERR_INITIALIZATION, SC_ERR_INVALID_ARGUMENTS, SCLogError, SCMalloc, SIG_FLAG_TOCLIENT, SIG_FLAG_TOSERVER, DetectEngineAppInspectionEngine_::sm_list, and unlikely.

Here is the call graph for this function:

◆ DetectAppLayerInspectEngineRegister2()

void DetectAppLayerInspectEngineRegister2	(	const char *	name,
		AppProto	alproto,
		uint32_t	dir,
		int	progress,
		InspectEngineFuncPtr2	Callback2,
		InspectionBufferGetDataPtr	GetData
	)

register inspect engine at start up time

Note: errors are fatal

Definition at line 231 of file detect-engine.c.

◆ DetectBufferGetActiveList()

int DetectBufferGetActiveList	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

Definition at line 985 of file detect-engine.c.

References BUG_ON, de_ctx, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_NOTSET, DetectBufferTypeGetByIdTransforms(), Signature_::init_data, SignatureInitData_::list, SignatureInitData_::list_set, SC_ERR_INVALID_SIGNATURE, SCLogDebug, SCLogError, SCReturnInt, SignatureInitData_::transform_cnt, and SignatureInitData_::transforms.

Referenced by DetectContentSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectBufferRunSetupCallback()

void DetectBufferRunSetupCallback	(	const DetectEngineCtx *	de_ctx,
		const int	id,
		Signature *	s
	)

Definition at line 943 of file detect-engine.c.

◆ DetectBufferRunValidateCallback()

bool DetectBufferRunValidateCallback	(	const DetectEngineCtx *	de_ctx,
		const int	id,
		const Signature *	s,
		const char **	sigerror
	)

Definition at line 962 of file detect-engine.c.

◆ DetectBufferSetActiveList()

int WARN_UNUSED DetectBufferSetActiveList	(	Signature *	s,
		const int	list
	)

Definition at line 972 of file detect-engine.c.

◆ DetectBufferTypeCloseRegistration()

void DetectBufferTypeCloseRegistration ( void )

Definition at line 1237 of file detect-engine.c.

References BUG_ON.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectBufferTypeGetByIdTransforms()

int DetectBufferTypeGetByIdTransforms	(	DetectEngineCtx *	de_ctx,
		const int	id,
		int *	transforms,
		int	transform_cnt
	)

Definition at line 1244 of file detect-engine.c.

Referenced by DetectBufferGetActiveList().

Here is the caller graph for this function:

◆ DetectBufferTypeGetByName()

int DetectBufferTypeGetByName ( const char * name )

Definition at line 860 of file detect-engine.c.

Referenced by DetectAppLayerInspectEngineRegister(), DetectEngineAppInspectionEngine2Signature(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeGetDescriptionById()

const char* DetectBufferTypeGetDescriptionById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 897 of file detect-engine.c.

◆ DetectBufferTypeGetDescriptionByName()

const char* DetectBufferTypeGetDescriptionByName ( const char * name )

Definition at line 906 of file detect-engine.c.

◆ DetectBufferTypeGetNameById()

const char* DetectBufferTypeGetNameById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 869 of file detect-engine.c.

References DetectEngineCtx_::buffer_type_map, DetectEngineCtx_::buffer_type_map_elements, BUG_ON, de_ctx, and DetectBufferType_::string.

Referenced by DetectEngineAppInspectionEngine2Signature(), EngineAnalysisRules2(), and SignatureIsIPOnly().

Here is the caller graph for this function:

◆ DetectBufferTypeMaxId()

int DetectBufferTypeMaxId ( void )

Definition at line 735 of file detect-engine.c.

Referenced by SigAlloc().

Here is the caller graph for this function:

◆ DetectBufferTypeRegister()

int DetectBufferTypeRegister ( const char * name )

Definition at line 816 of file detect-engine.c.

References BUG_ON.

Referenced by DetectAppLayerInspectEngineRegister(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeRegisterSetupCallback()

void DetectBufferTypeRegisterSetupCallback	(	const char *	name,
		void()(const DetectEngineCtx , Signature *)	Callback
	)

Definition at line 933 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeRegisterValidateCallback()

void DetectBufferTypeRegisterValidateCallback	(	const char *	name,
		bool()(const Signature , const char **sigerror)	ValidateCallback
	)

Definition at line 952 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSetDescriptionByName()

void DetectBufferTypeSetDescriptionByName	(	const char *	name,
		const char *	desc
	)

Definition at line 888 of file detect-engine.c.

◆ DetectBufferTypeSupportsMpm()

void DetectBufferTypeSupportsMpm ( const char * name )

Definition at line 840 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsMpmGetById()

bool DetectBufferTypeSupportsMpmGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 924 of file detect-engine.c.

Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsPacket()

void DetectBufferTypeSupportsPacket ( const char * name )

Definition at line 830 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsPacketGetById()

bool DetectBufferTypeSupportsPacketGetById	(	const DetectEngineCtx *	de_ctx,
		const int	id
	)

Definition at line 915 of file detect-engine.c.

◆ DetectBufferTypeSupportsTransformations()

void DetectBufferTypeSupportsTransformations ( const char * name )

Definition at line 850 of file detect-engine.c.

References BUG_ON.

◆ DetectEngineAddToMaster()

int DetectEngineAddToMaster ( DetectEngineCtx * de_ctx )

Definition at line 3849 of file detect-engine.c.

References de_ctx, and SCLogDebug.

◆ DetectEngineAppInspectionEngine2Signature()

int DetectEngineAppInspectionEngine2Signature	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

Note: for the file inspect engine, the id DE_STATE_ID_FILE_INSPECT is assigned.

Definition at line 466 of file detect-engine.c.

Here is the call graph for this function:

◆ DetectEngineAppInspectionEngineSignatureFree()

void DetectEngineAppInspectionEngineSignatureFree ( Signature * s )

free app inspect engines for a signature

For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.

Definition at line 667 of file detect-engine.c.

References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, SigTableElmt_::Free, SigMatchData_::is_last, MAX, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::sm_list, DetectEnginePktInspectionEngine::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, and SigMatchData_::type.

◆ DetectEngineBumpVersion()

void DetectEngineBumpVersion ( void )

Definition at line 3115 of file detect-engine.c.

◆ DetectEngineCtxFree()

void DetectEngineCtxFree ( DetectEngineCtx * de_ctx )

Free a DetectEngineCtx::

Parameters

de_ctx DetectEngineCtx:: to be freed

Definition at line 2030 of file detect-engine.c.

References de_ctx, DetectParseDupSigHashFree(), MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_ctx, DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingRuleDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::spm_global_thread_ctx, SpmDestroyGlobalThreadCtx(), and ThresholdContextDestroy().

Here is the call graph for this function:

◆ DetectEngineCtxInit()

DetectEngineCtx* DetectEngineCtxInit ( void )

Definition at line 1985 of file detect-engine.c.

Referenced by DetectEngineCtxInitWithPrefix().

Here is the caller graph for this function:

◆ DetectEngineCtxInitStubForDD()

DetectEngineCtx* DetectEngineCtxInitStubForDD ( void )

Definition at line 1980 of file detect-engine.c.

◆ DetectEngineCtxInitStubForMT()

DetectEngineCtx* DetectEngineCtxInitStubForMT ( void )

Definition at line 1975 of file detect-engine.c.

◆ DetectEngineCtxInitWithPrefix()

DetectEngineCtx* DetectEngineCtxInitWithPrefix ( const char * prefix )

Definition at line 1990 of file detect-engine.c.

References DetectEngineCtxInit().

Here is the call graph for this function:

◆ DetectEngineDeReference()

void DetectEngineDeReference ( DetectEngineCtx ** de_ctx )

Definition at line 3825 of file detect-engine.c.

References BUG_ON, and de_ctx.

◆ DetectEngineEnabled()

int DetectEngineEnabled ( void )

Check if detection is enabled.

Return values

bool	true or false

Definition at line 3091 of file detect-engine.c.

◆ DetectEngineGetByTenantId()

DetectEngineCtx* DetectEngineGetByTenantId ( int tenant_id )

Definition at line 3799 of file detect-engine.c.

◆ DetectEngineGetCurrent()

DetectEngineCtx* DetectEngineGetCurrent ( void )

Definition at line 3124 of file detect-engine.c.

Referenced by DetectEngineThreadCtxInit().

Here is the caller graph for this function:

◆ DetectEngineGetVersion()

uint32_t DetectEngineGetVersion ( void )

Definition at line 3105 of file detect-engine.c.

References version.

◆ DetectEngineInspectBufferGeneric()

int DetectEngineInspectBufferGeneric	(	DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const DetectEngineAppInspectionEngine *	engine,
		const Signature *	s,
		Flow *	f,
		uint8_t	flags,
		void *	alstate,
		void *	txv,
		uint64_t	tx_id
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
f	Flow
flags	app layer flags
state	App layer state

Return values

0	no match.
1	match.
2	Sig can't match.

Definition at line 1578 of file detect-engine.c.

References Flow_::alproto, AppLayerParserGetStateProgress(), DetectEngineThreadCtx_::buffer_offset, de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.

Here is the call graph for this function:

◆ DetectEngineInspectGenericList()

int DetectEngineInspectGenericList	(	ThreadVars *	tv,
		const DetectEngineCtx *	de_ctx,
		DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		const SigMatchData *	smd,
		Flow *	f,
		const uint8_t	flags,
		void *	alstate,
		void *	txv,
		uint64_t	tx_id
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
sm	SigMatch to inspect
f	Flow
flags	app layer flags
state	App layer state

Return values

0	no match
1	match

Definition at line 1533 of file detect-engine.c.

References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, and SigMatchData_::type.

Referenced by DetectEngineInspectDnsRequest(), and DetectEngineInspectDnsResponse().

Here is the caller graph for this function:

◆ DetectEngineInspectPktBufferGeneric()

int DetectEngineInspectPktBufferGeneric	(	DetectEngineThreadCtx *	det_ctx,
		const DetectEnginePktInspectionEngine *	engine,
		const Signature *	s,
		Packet *	p,
		uint8_t *	_alert_flags
	)

Do the content inspection & validation for a signature.

Parameters

de_ctx	Detection engine context
det_ctx	Detection engine thread context
s	Signature to inspect
p	Packet

Return values

0	no match.
1	match.

Definition at line 1643 of file detect-engine.c.

References DetectEngineThreadCtx_::buffer_offset, DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEnginePktInspectionEngine::mpm, offset, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectEngineLoadTenantBlocking()

int DetectEngineLoadTenantBlocking	(	uint32_t	tenant_id,
		const char *	yaml
	)

Load a tenant and wait for loading to complete.

Definition at line 3350 of file detect-engine.c.

◆ DetectEngineMoveToFreeList()

int DetectEngineMoveToFreeList ( DetectEngineCtx * de_ctx )

Definition at line 3865 of file detect-engine.c.

◆ DetectEngineMTApply()

int DetectEngineMTApply ( void )

Definition at line 4056 of file detect-engine.c.

◆ DetectEngineMultiTenantEnabled()

int DetectEngineMultiTenantEnabled ( void )

TODO locking? Not needed if this is a one time setting at startup

Definition at line 3156 of file detect-engine.c.

◆ DetectEngineMultiTenantSetup()

int DetectEngineMultiTenantSetup ( void )

setup multi-detect / multi-tenancy

See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.

Definition at line 3499 of file detect-engine.c.

References TENANT_SELECTOR_UNKNOWN.

◆ DetectEngineMustParseMetadata()

int DetectEngineMustParseMetadata ( void )

Definition at line 4121 of file detect-engine.c.

Referenced by DetectMetadataHashInit().

Here is the caller graph for this function:

◆ DetectEnginePktInspectionRun()

bool DetectEnginePktInspectionRun	(	ThreadVars *	tv,
		DetectEngineThreadCtx *	det_ctx,
		const Signature *	s,
		Flow *	f,
		Packet *	p,
		uint8_t *	alert_flags
	)

Definition at line 1394 of file detect-engine.c.

References Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, and SCLogDebug.

◆ DetectEnginePktInspectionSetup()

int DetectEnginePktInspectionSetup ( Signature * s )

Definition at line 1439 of file detect-engine.c.

References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.

◆ DetectEnginePruneFreeList()

void DetectEnginePruneFreeList ( void )

Definition at line 3916 of file detect-engine.c.

◆ DetectEngineReference()

DetectEngineCtx* DetectEngineReference ( DetectEngineCtx * )

Definition at line 3147 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::ref_cnt.

◆ DetectEngineRegisterTests()

void DetectEngineRegisterTests ( void )

Definition at line 4422 of file detect-engine.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ DetectEngineReload()

int DetectEngineReload ( const SCInstance * suri )

Reload the detection engine.

Parameters

filename YAML file to load for the detect config

Return values

-1	error
0	ok

Definition at line 3955 of file detect-engine.c.

References SCInstance_::conf_filename, and SCLogNotice.

◆ DetectEngineReloadIsIdle()

int DetectEngineReloadIsIdle ( void )

Definition at line 1509 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadIsStart()

int DetectEngineReloadIsStart ( void )

Definition at line 1489 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadSetIdle()

void DetectEngineReloadSetIdle ( void )

Definition at line 1501 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadStart()

int DetectEngineReloadStart ( void )

Definition at line 1475 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadTenantBlocking()

int DetectEngineReloadTenantBlocking	(	uint32_t	tenant_id,
		const char *	yaml,
		int	reload_cnt
	)

Reload a tenant and wait for loading to complete.

Definition at line 3364 of file detect-engine.c.

◆ DetectEngineResetMaxSigId()

void DetectEngineResetMaxSigId ( DetectEngineCtx * )

Definition at line 2403 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::signum.

Referenced by SigCleanSignatures().

Here is the caller graph for this function:

◆ DetectEngineSetParseMetadata()

void DetectEngineSetParseMetadata ( void )

Definition at line 4111 of file detect-engine.c.

◆ DetectEngineTentantRegisterLivedev()

int DetectEngineTentantRegisterLivedev	(	uint32_t	tenant_id,
		int	device_id
	)

Definition at line 3767 of file detect-engine.c.

◆ DetectEngineTentantRegisterPcapFile()

int DetectEngineTentantRegisterPcapFile ( uint32_t tenant_id )

Definition at line 3782 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTentantRegisterVlanId()

int DetectEngineTentantRegisterVlanId	(	uint32_t	tenant_id,
		uint16_t	vlan_id
	)

Definition at line 3772 of file detect-engine.c.

◆ DetectEngineTentantUnregisterPcapFile()

int DetectEngineTentantUnregisterPcapFile ( uint32_t tenant_id )

Definition at line 3788 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTentantUnregisterVlanId()

int DetectEngineTentantUnregisterVlanId	(	uint32_t	tenant_id,
		uint16_t	vlan_id
	)

Definition at line 3777 of file detect-engine.c.

◆ DetectEngineThreadCtxDeinit()

TmEcode DetectEngineThreadCtxDeinit	(	ThreadVars *	,
		void *
	)

Definition at line 2934 of file detect-engine.c.

References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SC_ERR_INVALID_ARGUMENTS, SCLogWarning, and TM_ECODE_OK.

Referenced by DetectEngineThreadCtxInit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ DetectEngineThreadCtxInit()

TmEcode DetectEngineThreadCtxInit	(	ThreadVars *	tv,
		void *	initdata,
		void **	data
	)

initialize thread specific detection engine context

Note: there is a special case when using delayed detect. In this case the function is called twice per thread. The first time the rules are not yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd time they will be loaded. de_ctx->delayed_detect_initialized will be 1. This is needed to do the per thread counter registration before the packet runtime starts. In delayed detect mode, the first call will return a NULL ptr through the data ptr.

Parameters

tv	ThreadVars for this thread
initdata	pointer to de_ctx
data[out]	pointer to store our thread detection ctx

Return values

TM_ECODE_OK	if all went well
TM_ECODE_FAILED	on serious errors

alert counter setup

Definition at line 2726 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCMalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Here is the call graph for this function:

◆ DetectEngineUnsetParseMetadata()

void DetectEngineUnsetParseMetadata ( void )

Definition at line 4116 of file detect-engine.c.

◆ DetectPktInspectEngineRegister()

void DetectPktInspectEngineRegister	(	const char *	name,
		InspectionBufferGetPktDataPtr	GetPktData,
		InspectionBufferPktInspectFunc	Callback
	)

register inspect engine at start up time

Note: errors are fatal

Definition at line 128 of file detect-engine.c.

References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, SC_ERR_INITIALIZATION, SC_ERR_INVALID_ARGUMENTS, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectRegisterThreadCtxGlobalFuncs()

int DetectRegisterThreadCtxGlobalFuncs	(	const char *	name,
		void ()(void *)	InitFunc,
		void *	data,
		void()(void )	FreeFunc
	)

Register Thread keyword context Funcs (Global)

IDs stay static over reloads and between tenants

Parameters

name	keyword name for error printing
InitFunc	function ptr
FreeFunc	function ptr

Return values

id	for retrieval of ctx at runtime
-1	on error

Definition at line 3035 of file detect-engine.c.

References BUG_ON.

◆ DetectSigmatchListEnumToString()

const char* DetectSigmatchListEnumToString ( enum DetectSigmatchListEnum type )

Definition at line 4126 of file detect-engine.c.

References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.

◆ DetectThreadCtxGetGlobalKeywordThreadCtx()

void* DetectThreadCtxGetGlobalKeywordThreadCtx	(	DetectEngineThreadCtx *	det_ctx,
		int	id
	)

Retrieve thread local keyword ctx by id.

Parameters

det_ctx	detection engine thread ctx to retrieve the ctx from
id	id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.

Return values

ctx	or NULL on error

Definition at line 3079 of file detect-engine.c.

References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.

Referenced by HttpHeaderGetBufferSpaceForTXID().

Here is the caller graph for this function:

◆ InspectionBufferApplyTransforms()

void InspectionBufferApplyTransforms	(	InspectionBuffer *	buffer,
		const DetectEngineTransforms *	transforms
	)

Definition at line 1148 of file detect-engine.c.

References BUG_ON, DETECT_TRANSFORMS_MAX, SCLogDebug, sigmatch_table, SigTableElmt_::Transform, and DetectEngineTransforms::transforms.

◆ InspectionBufferCheckAndExpand()

void InspectionBufferCheckAndExpand	(	InspectionBuffer *	buffer,
		uint32_t	min_size
	)

make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary

Definition at line 1119 of file detect-engine.c.

References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.

Referenced by FileSwfDecompression(), and InspectionBufferCopy().

Here is the caller graph for this function:

◆ InspectionBufferClean()

void InspectionBufferClean ( DetectEngineThreadCtx * det_ctx )

Definition at line 1015 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.

◆ InspectionBufferCopy()

void InspectionBufferCopy	(	InspectionBuffer *	buffer,
		uint8_t *	buf,
		uint32_t	buf_len
	)

Definition at line 1136 of file detect-engine.c.

References InspectionBuffer::buf, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.

Here is the call graph for this function:

◆ InspectionBufferFree()

void InspectionBufferFree ( InspectionBuffer * buffer )

Definition at line 1107 of file detect-engine.c.

References InspectionBuffer::buf, and SCFree.

◆ InspectionBufferGet()

InspectionBuffer* InspectionBufferGet	(	DetectEngineThreadCtx *	det_ctx,
		const int	list_id
	)

Definition at line 1041 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.

◆ InspectionBufferGetMulti()

InspectionBufferMultipleForList* InspectionBufferGetMulti	(	DetectEngineThreadCtx *	det_ctx,
		const int	list_id
	)

Definition at line 1080 of file detect-engine.c.

References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.

◆ InspectionBufferInit()

void InspectionBufferInit	(	InspectionBuffer *	buffer,
		uint32_t	initial_size
	)

Definition at line 1090 of file detect-engine.c.

References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.

◆ InspectionBufferMultipleForListGet()

InspectionBuffer* InspectionBufferMultipleForListGet	(	InspectionBufferMultipleForList *	fb,
		uint32_t	local_id
	)

for a InspectionBufferMultipleForList get a InspectionBuffer

Parameters

fb	the multiple buffer array
local_id	the index to get a buffer
buffer	the inspect buffer or NULL in case of error

Definition at line 1054 of file detect-engine.c.

References InspectionBufferMultipleForList::inspection_buffers, MAX, InspectionBufferMultipleForList::max, SCLogDebug, SCRealloc, and InspectionBufferMultipleForList::size.

◆ InspectionBufferSetup()

void InspectionBufferSetup	(	InspectionBuffer *	buffer,
		const uint8_t *	data,
		const uint32_t	data_len
	)

setup the buffer with our initial data

Definition at line 1100 of file detect-engine.c.

References InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::len, InspectionBuffer::orig, and InspectionBuffer::orig_len.

Macros

Functions

Detailed Description

Macro Definition Documentation

◆ DetectEngineGetMaxSigId

Function Documentation

◆ DetectAppLayerInspectEngineRegister()

◆ DetectAppLayerInspectEngineRegister2()

◆ DetectBufferGetActiveList()

◆ DetectBufferRunSetupCallback()

◆ DetectBufferRunValidateCallback()

◆ DetectBufferSetActiveList()

◆ DetectBufferTypeCloseRegistration()

◆ DetectBufferTypeGetByIdTransforms()

◆ DetectBufferTypeGetByName()

◆ DetectBufferTypeGetDescriptionById()

◆ DetectBufferTypeGetDescriptionByName()

◆ DetectBufferTypeGetNameById()

◆ DetectBufferTypeMaxId()

◆ DetectBufferTypeRegister()

◆ DetectBufferTypeRegisterSetupCallback()

◆ DetectBufferTypeRegisterValidateCallback()

◆ DetectBufferTypeSetDescriptionByName()

◆ DetectBufferTypeSupportsMpm()

◆ DetectBufferTypeSupportsMpmGetById()

◆ DetectBufferTypeSupportsPacket()

◆ DetectBufferTypeSupportsPacketGetById()

◆ DetectBufferTypeSupportsTransformations()

◆ DetectEngineAddToMaster()

◆ DetectEngineAppInspectionEngine2Signature()

◆ DetectEngineAppInspectionEngineSignatureFree()

◆ DetectEngineBumpVersion()

◆ DetectEngineCtxFree()

◆ DetectEngineCtxInit()

◆ DetectEngineCtxInitStubForDD()

◆ DetectEngineCtxInitStubForMT()

◆ DetectEngineCtxInitWithPrefix()

◆ DetectEngineDeReference()

◆ DetectEngineEnabled()

◆ DetectEngineGetByTenantId()

◆ DetectEngineGetCurrent()

◆ DetectEngineGetVersion()

◆ DetectEngineInspectBufferGeneric()

◆ DetectEngineInspectGenericList()

◆ DetectEngineInspectPktBufferGeneric()

◆ DetectEngineLoadTenantBlocking()

◆ DetectEngineMoveToFreeList()

◆ DetectEngineMTApply()

◆ DetectEngineMultiTenantEnabled()

◆ DetectEngineMultiTenantSetup()

◆ DetectEngineMustParseMetadata()

◆ DetectEnginePktInspectionRun()

◆ DetectEnginePktInspectionSetup()

◆ DetectEnginePruneFreeList()

◆ DetectEngineReference()

◆ DetectEngineRegisterTests()

◆ DetectEngineReload()

◆ DetectEngineReloadIsIdle()

◆ DetectEngineReloadIsStart()

◆ DetectEngineReloadSetIdle()

◆ DetectEngineReloadStart()

◆ DetectEngineReloadTenantBlocking()

◆ DetectEngineResetMaxSigId()

◆ DetectEngineSetParseMetadata()

◆ DetectEngineTentantRegisterLivedev()

◆ DetectEngineTentantRegisterPcapFile()

◆ DetectEngineTentantRegisterVlanId()

◆ DetectEngineTentantUnregisterPcapFile()

◆ DetectEngineTentantUnregisterVlanId()

◆ DetectEngineThreadCtxDeinit()

◆ DetectEngineThreadCtxInit()

◆ DetectEngineUnsetParseMetadata()

◆ DetectPktInspectEngineRegister()

◆ DetectRegisterThreadCtxGlobalFuncs()

◆ DetectSigmatchListEnumToString()

◆ DetectThreadCtxGetGlobalKeywordThreadCtx()

◆ InspectionBufferApplyTransforms()

◆ InspectionBufferCheckAndExpand()

◆ InspectionBufferClean()

◆ InspectionBufferCopy()