suricata
Macros | Functions
detect-engine.h File Reference
#include "detect.h"
#include "suricata.h"
Include dependency graph for detect-engine.h:

Go to the source code of this file.

Macros

#define DetectEngineGetMaxSigId(de_ctx)   ((de_ctx)->signum)
 

Functions

const char * DetectTableToString (enum DetectTable table)
 
int DetectBufferTypeRegister (const char *name)
 
int DetectBufferTypeGetByName (const char *name)
 
void DetectBufferTypeSupportsMpm (const char *name)
 
void DetectBufferTypeSupportsPacket (const char *name)
 
void DetectBufferTypeSupportsFrames (const char *name)
 
void DetectBufferTypeSupportsTransformations (const char *name)
 
void DetectBufferTypeSupportsMultiInstance (const char *name)
 
int DetectBufferTypeMaxId (void)
 
void DetectBufferTypeCloseRegistration (void)
 
void DetectBufferTypeSetDescriptionByName (const char *name, const char *desc)
 
const char * DetectBufferTypeGetDescriptionByName (const char *name)
 
void DetectBufferTypeRegisterSetupCallback (const char *name, void(*Callback)(const DetectEngineCtx *, Signature *))
 
void DetectBufferTypeRegisterValidateCallback (const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror, const DetectBufferType *))
 
int DetectEngineBufferTypeRegisterWithFrameEngines (DetectEngineCtx *de_ctx, const char *name, const int direction, const AppProto alproto, const uint8_t frame_type)
 
int DetectEngineBufferTypeRegister (DetectEngineCtx *de_ctx, const char *name)
 
const char * DetectEngineBufferTypeGetNameById (const DetectEngineCtx *de_ctx, const int id)
 
const DetectBufferType * DetectEngineBufferTypeGetById (const DetectEngineCtx *de_ctx, const int id)
 
bool DetectEngineBufferTypeSupportsMpmGetById (const DetectEngineCtx *de_ctx, const int id)
 
bool DetectEngineBufferTypeSupportsPacketGetById (const DetectEngineCtx *de_ctx, const int id)
 
bool DetectEngineBufferTypeSupportsMultiInstanceGetById (const DetectEngineCtx *de_ctx, const int id)
 
bool DetectEngineBufferTypeSupportsFramesGetById (const DetectEngineCtx *de_ctx, const int id)
 
const char * DetectEngineBufferTypeGetDescriptionById (const DetectEngineCtx *de_ctx, const int id)
 
int DetectEngineBufferTypeGetByIdTransforms (DetectEngineCtx *de_ctx, const int id, TransformData *transforms, int transform_cnt)
 
void DetectEngineBufferRunSetupCallback (const DetectEngineCtx *de_ctx, const int id, Signature *s)
 
bool DetectEngineBufferRunValidateCallback (const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
 
bool DetectEngineBufferTypeValidateTransform (DetectEngineCtx *de_ctx, int sm_list, const uint8_t *content, uint16_t content_len, const char **namestr)
 Check content byte array compatibility with transforms. More...
 
void DetectEngineBufferTypeSupportsFrames (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsPacket (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsMpm (DetectEngineCtx *de_ctx, const char *name)
 
void DetectEngineBufferTypeSupportsTransformations (DetectEngineCtx *de_ctx, const char *name)
 
DetectEngineCtx * DetectEngineCtxInitWithPrefix (const char *prefix, uint32_t tenant_id)
 
DetectEngineCtx * DetectEngineCtxInit (void)
 
DetectEngineCtx * DetectEngineCtxInitStubForDD (void)
 
DetectEngineCtx * DetectEngineCtxInitStubForMT (void)
 
void DetectEngineCtxFree (DetectEngineCtx *)
 Free a DetectEngineCtx:: More...
 
int DetectEngineThreadCtxGetJsonContext (DetectEngineThreadCtx *det_ctx)
 
int DetectRegisterThreadCtxGlobalFuncs (const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
 Register Thread keyword context Funcs (Global) More...
 
void * DetectThreadCtxGetGlobalKeywordThreadCtx (DetectEngineThreadCtx *det_ctx, int id)
 Retrieve thread local keyword ctx by id. More...
 
TmEcode DetectEngineThreadCtxInit (ThreadVars *, void *, void **)
 initialize thread specific detection engine context More...
 
TmEcode DetectEngineThreadCtxDeinit (ThreadVars *, void *)
 
bool DetectEngineMpmCachingEnabled (void)
 
const char * DetectEngineMpmCachingGetPath (void)
 
void DetectEngineResetMaxSigId (DetectEngineCtx *)
 
void DetectEngineRegisterTests (void)
 
const char * DetectSigmatchListEnumToString (enum DetectSigmatchListEnum type)
 
uint32_t DetectEngineGetVersion (void)
 
void DetectEngineBumpVersion (void)
 
int DetectEngineAddToMaster (DetectEngineCtx *de_ctx)
 
DetectEngineCtx * DetectEngineGetCurrent (void)
 
DetectEngineCtx * DetectEngineGetByTenantId (uint32_t tenant_id)
 
void DetectEnginePruneFreeList (void)
 
int DetectEngineMoveToFreeList (DetectEngineCtx *de_ctx)
 
void DetectEngineClearMaster (void)
 
DetectEngineCtx * DetectEngineReference (DetectEngineCtx *)
 
void DetectEngineDeReference (DetectEngineCtx **de_ctx)
 
int DetectEngineReload (const SCInstance *suri)
 Reload the detection engine. More...
 
int DetectEngineEnabled (void)
 Check if detection is enabled. More...
 
int DetectEngineMTApply (void)
 
int DetectEngineMultiTenantEnabled (void)
 
int DetectEngineMultiTenantSetup (const bool unix_socket)
 setup multi-detect / multi-tenancy More...
 
int DetectEngineReloadStart (void)
 
int DetectEngineReloadIsStart (void)
 
void DetectEngineReloadSetIdle (void)
 
int DetectEngineReloadIsIdle (void)
 
int DetectEngineLoadTenantBlocking (uint32_t tenant_id, const char *yaml)
 Load a tenant and wait for loading to complete. More...
 
int DetectEngineReloadTenantBlocking (uint32_t tenant_id, const char *yaml, int reload_cnt)
 Reload a tenant and wait for loading to complete. More...
 
int DetectEngineReloadTenantsBlocking (const int reload_cnt)
 Reload all tenants and wait for loading to complete. More...
 
int DetectEngineTenantRegisterLivedev (uint32_t tenant_id, int device_id)
 
int DetectEngineTenantRegisterVlanId (uint32_t tenant_id, uint16_t vlan_id)
 
int DetectEngineTenantUnregisterVlanId (uint32_t tenant_id, uint16_t vlan_id)
 
int DetectEngineTenantRegisterPcapFile (uint32_t tenant_id)
 
int DetectEngineTenantUnregisterPcapFile (uint32_t tenant_id)
 
uint8_t DetectEngineInspectGenericList (DetectEngineCtx *, DetectEngineThreadCtx *, const struct DetectEngineAppInspectionEngine_ *, const Signature *, Flow *, uint8_t, void *, void *, uint64_t)
 Do the content inspection & validation for a signature. More...
 
uint8_t DetectEngineInspectBufferGeneric (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 Do the content inspection & validation for a signature. More...
 
uint8_t DetectEngineInspectBufferSingle (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 Do the content inspection & validation for a signature. More...
 
InspectionBuffer * DetectGetSingleData (struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, InspectionSingleBufferGetDataPtr GetBuf)
 
InspectionBuffer * DetectGetMultiData (struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, uint32_t index, InspectionMultiBufferGetDataPtr GetBuf)
 
uint8_t DetectEngineInspectMultiBufferGeneric (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
 
int DetectEngineInspectPktBufferGeneric (DetectEngineThreadCtx *det_ctx, const DetectEnginePktInspectionEngine *engine, const Signature *s, Packet *p, uint8_t *alert_flags)
 Do the content inspection & validation for a signature. More...
 
void DetectAppLayerInspectEngineRegister (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback2, InspectionBufferGetDataPtr GetData)
 Registers an app inspection engine. More...
 
void DetectAppLayerInspectEngineRegisterSingle (const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback2, InspectionSingleBufferGetDataPtr GetData)
 
void DetectAppLayerMultiRegister (const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
 
void DetectPktInspectEngineRegister (const char *name, InspectionBufferGetPktDataPtr GetPktData, InspectionBufferPktInspectFunc Callback)
 register inspect engine at start up time More...
 
void DetectEngineFrameInspectEngineRegister (DetectEngineCtx *de_ctx, const char *name, int dir, InspectionBufferFrameInspectFunc Callback, AppProto alproto, uint8_t type)
 register inspect engine at start up time More...
 
int DetectEngineAppInspectionEngine2Signature (DetectEngineCtx *de_ctx, Signature *s)
 
void DetectEngineAppInspectionEngineSignatureFree (DetectEngineCtx *, Signature *s)
 free app inspect engines for a signature More...
 
bool DetectEnginePktInspectionRun (ThreadVars *tv, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, Packet *p, uint8_t *alert_flags)
 
int DetectEnginePktInspectionSetup (Signature *s)
 
void DetectEngineSetParseMetadata (void)
 
void DetectEngineUnsetParseMetadata (void)
 
int DetectEngineMustParseMetadata (void)
 
bool DetectBufferIsPresent (const Signature *s, const uint32_t buf_id)
 
DetectEngineThreadCtx * DetectEngineThreadCtxInitForReload (ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt)
 
void DetectRunStoreStateTx (const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match)
 
void DetectEngineStateResetTxs (Flow *f)
 Reset de state for active tx' To be used on detect engine reload. More...
 
bool DetectMd5ValidateCallback (const Signature *s, const char **sigerror, const DetectBufferType *map)
 
void DeStateRegisterTests (void)
 
void InjectPacketsForFlush (ThreadVars **detect_tvs, int no_of_detect_tvs)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Definition in file detect-engine.h.

Macro Definition Documentation

◆ DetectEngineGetMaxSigId

#define DetectEngineGetMaxSigId (   de_ctx)    ((de_ctx)->signum)

Definition at line 94 of file detect-engine.h.

Function Documentation

◆ DetectAppLayerInspectEngineRegister()

void DetectAppLayerInspectEngineRegister ( const char *  name,
AppProto  alproto,
uint32_t  dir,
int  progress,
InspectEngineFuncPtr  Callback2,
InspectionBufferGetDataPtr  GetData 
)

Registers an app inspection engine.

Parameters
nameName of the detection list
alprotoApp layer protocol for which we will register the engine.
directionThe direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT
progressMinimal progress value for inspect engine to run
CallbackThe engine callback.

Definition at line 272 of file detect-engine.c.

Referenced by DetectFileRegisterFileProtocols(), DetectRegisterAppLayerHookLists(), and SCDetectHelperBufferRegister().

Here is the caller graph for this function:

◆ DetectAppLayerInspectEngineRegisterSingle()

void DetectAppLayerInspectEngineRegisterSingle ( const char *  name,
AppProto  alproto,
uint32_t  dir,
int  progress,
InspectEngineFuncPtr  Callback2,
InspectionSingleBufferGetDataPtr  GetData 
)

Definition at line 294 of file detect-engine.c.

◆ DetectAppLayerMultiRegister()

void DetectAppLayerMultiRegister ( const char *  name,
AppProto  alproto,
uint32_t  dir,
int  progress,
InspectionMultiBufferGetDataPtr  GetData,
int  priority 
)

Definition at line 2109 of file detect-engine.c.

◆ DetectBufferIsPresent()

bool DetectBufferIsPresent ( const Signature *  s,
const uint32_t  buf_id 
)

Definition at line 1513 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, and Signature_::init_data.

◆ DetectBufferTypeCloseRegistration()

void DetectBufferTypeCloseRegistration ( void  )

Definition at line 1657 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeGetByName()

int DetectBufferTypeGetByName ( const char *  name)

Definition at line 1279 of file detect-engine.c.

Referenced by DetectEngineAppInspectionEngine2Signature(), DetectFrameMpmRegister(), and DetectPktInspectEngineRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeGetDescriptionByName()

const char* DetectBufferTypeGetDescriptionByName ( const char *  name)

Definition at line 1396 of file detect-engine.c.

◆ DetectBufferTypeMaxId()

int DetectBufferTypeMaxId ( void  )

Definition at line 1036 of file detect-engine.c.

◆ DetectBufferTypeRegister()

int DetectBufferTypeRegister ( const char *  name)

Definition at line 1215 of file detect-engine.c.

References BUG_ON.

Referenced by DetectPktInspectEngineRegister(), and SCDetectHelperBufferRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeRegisterSetupCallback()

void DetectBufferTypeRegisterSetupCallback ( const char *  name,
void(*)(const DetectEngineCtx *, Signature *)  Callback 
)

Definition at line 1473 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeRegisterValidateCallback()

void DetectBufferTypeRegisterValidateCallback ( const char *  name,
bool(*)(const Signature *, const char **sigerror, const DetectBufferType *)  ValidateCallback 
)

Definition at line 1491 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSetDescriptionByName()

void DetectBufferTypeSetDescriptionByName ( const char *  name,
const char *  desc 
)

Definition at line 1376 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsFrames()

void DetectBufferTypeSupportsFrames ( const char *  name)

Definition at line 1239 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsMpm()

void DetectBufferTypeSupportsMpm ( const char *  name)

Definition at line 1259 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectBufferTypeSupportsMultiInstance()

void DetectBufferTypeSupportsMultiInstance ( const char *  name)

Definition at line 1229 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsPacket()

void DetectBufferTypeSupportsPacket ( const char *  name)

Definition at line 1249 of file detect-engine.c.

References BUG_ON.

◆ DetectBufferTypeSupportsTransformations()

void DetectBufferTypeSupportsTransformations ( const char *  name)

Definition at line 1269 of file detect-engine.c.

References BUG_ON.

Referenced by DetectFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineAddToMaster()

int DetectEngineAddToMaster ( DetectEngineCtx *  de_ctx)

Definition at line 4657 of file detect-engine.c.

References de_ctx, and SCLogDebug.

◆ DetectEngineAppInspectionEngine2Signature()

int DetectEngineAppInspectionEngine2Signature ( DetectEngineCtx *  de_ctx,
Signature *  s 
)
Note
for the file inspect engine, the id DE_STATE_ID_FILE_INSPECT is assigned.

Definition at line 800 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, de_ctx, DE_STATE_FLAG_BASE, DetectBufferTypeGetByName(), DetectEngineBufferTypeGetById(), FatalError, DetectBufferType_::frame, DetectEngineCtx_::frame_inspect_engines, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::id, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, DetectEngineFrameInspectionEngine::next, SCLogDebug, SigMatchList2DataArray(), and DetectEngineFrameInspectionEngine::sm_list.

Here is the call graph for this function:

◆ DetectEngineAppInspectionEngineSignatureFree()

void DetectEngineAppInspectionEngineSignatureFree ( DetectEngineCtx *  de_ctx,
Signature *  s 
)

free app inspect engines for a signature

For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.

Definition at line 930 of file detect-engine.c.

References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.

◆ DetectEngineBufferRunSetupCallback()

void DetectEngineBufferRunSetupCallback ( const DetectEngineCtx *  de_ctx,
const int  id,
Signature *  s 
)

Definition at line 1483 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.

Here is the call graph for this function:

◆ DetectEngineBufferRunValidateCallback()

bool DetectEngineBufferRunValidateCallback ( const DetectEngineCtx *  de_ctx,
const int  id,
const Signature *  s,
const char **  sigerror 
)

Definition at line 1502 of file detect-engine.c.

References DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::transforms, and DetectBufferType_::ValidateCallback.

Here is the call graph for this function:

◆ DetectEngineBufferTypeGetById()

const DetectBufferType* DetectEngineBufferTypeGetById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1299 of file detect-engine.c.

References DetectEngineCtx_::buffer_type_hash_id, de_ctx, HashListTableLookup(), DetectBufferType_::id, and id.

Referenced by DetectEngineAppInspectionEngine2Signature(), DetectEngineBufferRunSetupCallback(), DetectEngineBufferRunValidateCallback(), DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeGetDescriptionById(), DetectEngineBufferTypeGetNameById(), DetectEngineBufferTypeSupportsFramesGetById(), DetectEngineBufferTypeSupportsMpmGetById(), DetectEngineBufferTypeSupportsMultiInstanceGetById(), DetectEngineBufferTypeSupportsPacketGetById(), and DetectEngineBufferTypeValidateTransform().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetByIdTransforms()

int DetectEngineBufferTypeGetByIdTransforms ( DetectEngineCtx *  de_ctx,
const int  id,
TransformData *  transforms,
int  transform_cnt 
)

Definition at line 1664 of file detect-engine.c.

References DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::name, SCLogDebug, SCLogError, strlcpy(), DetectBufferType_::supports_transforms, DetectEngineTransforms::transforms, and DetectBufferType_::transforms.

Referenced by DetectBufferGetActiveList().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetDescriptionById()

const char* DetectEngineBufferTypeGetDescriptionById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1387 of file detect-engine.c.

References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().

Referenced by EngineAnalysisFP().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeGetNameById()

const char* DetectEngineBufferTypeGetNameById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1309 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.

Referenced by DumpPatterns(), EngineAnalysisFP(), and EngineAnalysisRules2().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegister()

int DetectEngineBufferTypeRegister ( DetectEngineCtx *  de_ctx,
const char *  name 
)

Definition at line 1366 of file detect-engine.c.

Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeRegisterWithFrameEngines()

int DetectEngineBufferTypeRegisterWithFrameEngines ( DetectEngineCtx *  de_ctx,
const char *  name,
const int  direction,
const AppProto  alproto,
const uint8_t  frame_type 
)

Definition at line 1332 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsFrames()

void DetectEngineBufferTypeSupportsFrames ( DetectEngineCtx *  de_ctx,
const char *  name 
)

Definition at line 1405 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsFramesGetById()

bool DetectEngineBufferTypeSupportsFramesGetById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1464 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::frame, and SCLogDebug.

Here is the call graph for this function:

◆ DetectEngineBufferTypeSupportsMpm()

void DetectEngineBufferTypeSupportsMpm ( DetectEngineCtx *  de_ctx,
const char *  name 
)

Definition at line 1421 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMpmGetById()

bool DetectEngineBufferTypeSupportsMpmGetById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1455 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.

Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsMultiInstanceGetById()

bool DetectEngineBufferTypeSupportsMultiInstanceGetById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1437 of file detect-engine.c.

References BOOL2STR, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::multi_instance, and SCLogDebug.

Referenced by DetectBufferGetActiveList().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBufferTypeSupportsPacket()

void DetectEngineBufferTypeSupportsPacket ( DetectEngineCtx *  de_ctx,
const char *  name 
)

Definition at line 1413 of file detect-engine.c.

◆ DetectEngineBufferTypeSupportsPacketGetById()

bool DetectEngineBufferTypeSupportsPacketGetById ( const DetectEngineCtx *  de_ctx,
const int  id 
)

Definition at line 1446 of file detect-engine.c.

References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.

Here is the call graph for this function:

◆ DetectEngineBufferTypeSupportsTransformations()

void DetectEngineBufferTypeSupportsTransformations ( DetectEngineCtx *  de_ctx,
const char *  name 
)

Definition at line 1429 of file detect-engine.c.

Referenced by DetectEngineFrameMpmRegister().

Here is the caller graph for this function:

◆ DetectEngineBufferTypeValidateTransform()

bool DetectEngineBufferTypeValidateTransform ( DetectEngineCtx *  de_ctx,
int  sm_list,
const uint8_t *  content,
uint16_t  content_len,
const char **  namestr 
)

Check content byte array compatibility with transforms.

The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.

When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first validation failure terminates the loop.

Parameters
de_ctxDetection engine context.
sm_listThe SM list id.
contentThe byte array being validated
namestrreturns the name of the transform that is incompatible with content.
Return values
true(false) If any of the transforms indicate the byte array is (is not) compatible.

Definition at line 1541 of file detect-engine.c.

References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.

Referenced by DetectContentSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineBumpVersion()

void DetectEngineBumpVersion ( void  )

Definition at line 3833 of file detect-engine.c.

◆ DetectEngineClearMaster()

void DetectEngineClearMaster ( void  )

Definition at line 4757 of file detect-engine.c.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineCtxFree()

void DetectEngineCtxFree ( DetectEngineCtx *  de_ctx)

Free a DetectEngineCtx::

Parameters
de_ctxDetectEngineCtx:: to be freed

Definition at line 2643 of file detect-engine.c.

References MpmTableElmt_::ConfigDeinit, de_ctx, DetectEngineFreeFastPatternList(), DetectParseDupSigHashFree(), DetectEngineCtx_::filedata_config, DetectEngineCtx_::mpm_cfg, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::sm_types_prefilter, DetectEngineCtx_::sm_types_silent_error, DetectEngineCtx_::spm_global_thread_ctx, and SpmDestroyGlobalThreadCtx().

Here is the call graph for this function:

◆ DetectEngineCtxInit()

DetectEngineCtx* DetectEngineCtxInit ( void  )

Definition at line 2604 of file detect-engine.c.

Referenced by DetectEngineCtxInitWithPrefix().

Here is the caller graph for this function:

◆ DetectEngineCtxInitStubForDD()

DetectEngineCtx* DetectEngineCtxInitStubForDD ( void  )

Definition at line 2599 of file detect-engine.c.

◆ DetectEngineCtxInitStubForMT()

DetectEngineCtx* DetectEngineCtxInitStubForMT ( void  )

Definition at line 2594 of file detect-engine.c.

◆ DetectEngineCtxInitWithPrefix()

DetectEngineCtx* DetectEngineCtxInitWithPrefix ( const char *  prefix,
uint32_t  tenant_id 
)

Definition at line 2609 of file detect-engine.c.

References DetectEngineCtxInit().

Here is the call graph for this function:

◆ DetectEngineDeReference()

void DetectEngineDeReference ( DetectEngineCtx **  de_ctx)

Definition at line 4633 of file detect-engine.c.

References BUG_ON, and de_ctx.

Referenced by GlobalsDestroy(), and SCDetectEngineRegisterRateFilterCallback().

Here is the caller graph for this function:

◆ DetectEngineEnabled()

int DetectEngineEnabled ( void  )

Check if detection is enabled.

Return values
booltrue or false

Definition at line 3809 of file detect-engine.c.

◆ DetectEngineFrameInspectEngineRegister()

void DetectEngineFrameInspectEngineRegister ( DetectEngineCtx *  de_ctx,
const char *  name,
int  dir,
InspectionBufferFrameInspectFunc  Callback,
AppProto  alproto,
uint8_t  type 
)

register inspect engine at start up time

Note
errors are fatal

Definition at line 450 of file detect-engine.c.

References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, de_ctx, DETECT_SM_LIST_MATCH, DetectEngineBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, DetectEngineCtx_::frame_inspect_engines, name, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectEngineGetByTenantId()

DetectEngineCtx* DetectEngineGetByTenantId ( uint32_t  tenant_id)

Definition at line 4607 of file detect-engine.c.

◆ DetectEngineGetCurrent()

DetectEngineCtx* DetectEngineGetCurrent ( void  )

Definition at line 3842 of file detect-engine.c.

Referenced by DetectEngineThreadCtxInit(), GlobalsDestroy(), and SCDetectEngineRegisterRateFilterCallback().

Here is the caller graph for this function:

◆ DetectEngineGetVersion()

uint32_t DetectEngineGetVersion ( void  )

Definition at line 3823 of file detect-engine.c.

References version.

◆ DetectEngineInspectBufferGeneric()

uint8_t DetectEngineInspectBufferGeneric ( DetectEngineCtx *  de_ctx,
DetectEngineThreadCtx *  det_ctx,
const DetectEngineAppInspectionEngine *  engine,
const Signature *  s,
Flow *  f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
fFlow
flagsapp layer flags
stateApp layer state
Return values
0no match.
1match.
2Sig can't match.

Definition at line 2059 of file detect-engine.c.

References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.

Here is the call graph for this function:

◆ DetectEngineInspectBufferSingle()

uint8_t DetectEngineInspectBufferSingle ( DetectEngineCtx *  de_ctx,
DetectEngineThreadCtx *  det_ctx,
const DetectEngineAppInspectionEngine *  engine,
const Signature *  s,
Flow *  f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
fFlow
flagsapp layer flags
stateApp layer state
Return values
0no match.
1match.
2Sig can't match.

Definition at line 1998 of file detect-engine.c.

References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectGetSingleData(), flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetDataSingle, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.

Here is the call graph for this function:

◆ DetectEngineInspectGenericList()

uint8_t DetectEngineInspectGenericList ( DetectEngineCtx *  de_ctx,
DetectEngineThreadCtx *  det_ctx,
const struct DetectEngineAppInspectionEngine_ *  engine,
const Signature *  s,
Flow *  f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
smSigMatch to inspect
fFlow
flagsapp layer flags
stateApp layer state
Return values
0no match
1match

Definition at line 1956 of file detect-engine.c.

References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.

Referenced by DetectRegisterAppLayerHookLists(), and SCDetectHelperBufferRegister().

Here is the caller graph for this function:

◆ DetectEngineInspectMultiBufferGeneric()

uint8_t DetectEngineInspectMultiBufferGeneric ( DetectEngineCtx *  de_ctx,
DetectEngineThreadCtx *  det_ctx,
const DetectEngineAppInspectionEngine *  engine,
const Signature *  s,
Flow *  f,
uint8_t  flags,
void *  alstate,
void *  txv,
uint64_t  tx_id 
)

Definition at line 2159 of file detect-engine.c.

References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspectionBuffer(), DetectGetMultiData(), flags, DetectEngineAppInspectionEngine_::GetMultiData, InspectionBuffer::inspect, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, DetectEngineAppInspectionEngine_::progress, Flow_::proto, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, and DetectEngineAppInspectionEngine_::v2.

Here is the call graph for this function:

◆ DetectEngineInspectPktBufferGeneric()

int DetectEngineInspectPktBufferGeneric ( DetectEngineThreadCtx *  det_ctx,
const DetectEnginePktInspectionEngine *  engine,
const Signature *  s,
Packet *  p,
uint8_t *  _alert_flags 
)

Do the content inspection & validation for a signature.

Parameters
de_ctxDetection engine context
det_ctxDetection engine thread context
sSignature to inspect
pPacket
Return values
0no match.
1match.

Definition at line 2207 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEnginePktInspectionEngine::mpm, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectEngineLoadTenantBlocking()

int DetectEngineLoadTenantBlocking ( uint32_t  tenant_id,
const char *  yaml 
)

Load a tenant and wait for loading to complete.

Definition at line 4131 of file detect-engine.c.

◆ DetectEngineMoveToFreeList()

int DetectEngineMoveToFreeList ( DetectEngineCtx *  de_ctx)

Definition at line 4717 of file detect-engine.c.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ DetectEngineMpmCachingEnabled()

bool DetectEngineMpmCachingEnabled ( void  )

Definition at line 2464 of file detect-engine.c.

References SCConfGetBool().

Referenced by DetectEngineMpmCachingGetPath().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineMpmCachingGetPath()

const char* DetectEngineMpmCachingGetPath ( void  )

Definition at line 2473 of file detect-engine.c.

References DetectEngineMpmCachingEnabled(), SCConfGet(), and SCLogInfo.

Here is the call graph for this function:

◆ DetectEngineMTApply()

int DetectEngineMTApply ( void  )

Definition at line 4908 of file detect-engine.c.

◆ DetectEngineMultiTenantEnabled()

int DetectEngineMultiTenantEnabled ( void  )

TODO locking? Not needed if this is a one time setting at startup

Definition at line 3874 of file detect-engine.c.

◆ DetectEngineMultiTenantSetup()

int DetectEngineMultiTenantSetup ( const bool  unix_socket)

setup multi-detect / multi-tenancy

See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.

Definition at line 4294 of file detect-engine.c.

References TENANT_SELECTOR_UNKNOWN.

◆ DetectEngineMustParseMetadata()

int DetectEngineMustParseMetadata ( void  )

Definition at line 4975 of file detect-engine.c.

Referenced by DetectMetadataHashInit().

Here is the caller graph for this function:

◆ DetectEnginePktInspectionRun()

bool DetectEnginePktInspectionRun ( ThreadVars *  tv,
DetectEngineThreadCtx *  det_ctx,
const Signature *  s,
Flow *  f,
Packet *  p,
uint8_t *  alert_flags 
)

Definition at line 1814 of file detect-engine.c.

References DetectEnginePktInspectionEngine::Callback, DETECT_ENGINE_INSPECT_SIG_MATCH, Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, SCLogDebug, and DetectEnginePktInspectionEngine::v1.

◆ DetectEnginePktInspectionSetup()

int DetectEnginePktInspectionSetup ( Signature *  s)

Definition at line 1862 of file detect-engine.c.

References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.

◆ DetectEnginePruneFreeList()

void DetectEnginePruneFreeList ( void  )

Definition at line 4727 of file detect-engine.c.

◆ DetectEngineReference()

DetectEngineCtx* DetectEngineReference ( DetectEngineCtx *  )

Definition at line 3865 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::ref_cnt.

Referenced by DetectEngineThreadCtxInitForReload().

Here is the caller graph for this function:

◆ DetectEngineRegisterTests()

void DetectEngineRegisterTests ( void  )

Definition at line 5290 of file detect-engine.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ DetectEngineReload()

int DetectEngineReload ( const SCInstance *  suri)

Reload the detection engine.

Parameters
filenameYAML file to load for the detect config
Return values
-1error
0ok

Definition at line 4784 of file detect-engine.c.

References SCInstance_::conf_filename, and SCLogNotice.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadIsIdle()

int DetectEngineReloadIsIdle ( void  )

Definition at line 1932 of file detect-engine.c.

References SCMutexLock.

◆ DetectEngineReloadIsStart()

int DetectEngineReloadIsStart ( void  )

Definition at line 1912 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadSetIdle()

void DetectEngineReloadSetIdle ( void  )

Definition at line 1924 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadStart()

int DetectEngineReloadStart ( void  )

Definition at line 1898 of file detect-engine.c.

References SCMutexLock.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ DetectEngineReloadTenantBlocking()

int DetectEngineReloadTenantBlocking ( uint32_t  tenant_id,
const char *  yaml,
int  reload_cnt 
)

Reload a tenant and wait for loading to complete.

Definition at line 4145 of file detect-engine.c.

◆ DetectEngineReloadTenantsBlocking()

int DetectEngineReloadTenantsBlocking ( const int  reload_cnt)

Reload all tenants and wait for loading to complete.

Definition at line 4159 of file detect-engine.c.

◆ DetectEngineResetMaxSigId()

void DetectEngineResetMaxSigId ( DetectEngineCtx *  )

Definition at line 3055 of file detect-engine.c.

References de_ctx, and DetectEngineCtx_::signum.

Referenced by SigCleanSignatures().

Here is the caller graph for this function:

◆ DetectEngineSetParseMetadata()

void DetectEngineSetParseMetadata ( void  )

Definition at line 4965 of file detect-engine.c.

◆ DetectEngineTenantRegisterLivedev()

int DetectEngineTenantRegisterLivedev ( uint32_t  tenant_id,
int  device_id 
)

Definition at line 4574 of file detect-engine.c.

◆ DetectEngineTenantRegisterPcapFile()

int DetectEngineTenantRegisterPcapFile ( uint32_t  tenant_id)

Definition at line 4590 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTenantRegisterVlanId()

int DetectEngineTenantRegisterVlanId ( uint32_t  tenant_id,
uint16_t  vlan_id 
)

Definition at line 4580 of file detect-engine.c.

◆ DetectEngineTenantUnregisterPcapFile()

int DetectEngineTenantUnregisterPcapFile ( uint32_t  tenant_id)

Definition at line 4596 of file detect-engine.c.

References SCLogInfo, and TENANT_SELECTOR_DIRECT.

◆ DetectEngineTenantUnregisterVlanId()

int DetectEngineTenantUnregisterVlanId ( uint32_t  tenant_id,
uint16_t  vlan_id 
)

Definition at line 4585 of file detect-engine.c.

◆ DetectEngineThreadCtxDeinit()

TmEcode DetectEngineThreadCtxDeinit ( ThreadVars *  ,
void *   
)

Definition at line 3605 of file detect-engine.c.

References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SCLogWarning, and TM_ECODE_OK.

Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineThreadCtxGetJsonContext()

int DetectEngineThreadCtxGetJsonContext ( DetectEngineThreadCtx *  det_ctx)

Definition at line 5064 of file detect-engine.c.

References DetectEngineThreadCtx_::json_content, DetectEngineThreadCtx_::json_content_capacity, DetectEngineThreadCtx_::json_content_len, SCLogDebug, SCRealloc, SIG_JSON_CONTENT_ARRAY_LEN, and unlikely.

◆ DetectEngineThreadCtxInit()

TmEcode DetectEngineThreadCtxInit ( ThreadVars *  tv,
void *  initdata,
void **  data 
)

initialize thread specific detection engine context

Note
there is a special case when using delayed detect. In this case the function is called twice per thread. The first time the rules are not yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd time they will be loaded. de_ctx->delayed_detect_initialized will be 1. This is needed to do the per thread counter registration before the packet runtime starts. In delayed detect mode, the first call will return a NULL ptr through the data ptr.
Parameters
tvThreadVars for this thread
initdatapointer to de_ctx
data[out]pointer to store our thread detection ctx
Return values
TM_ECODE_OKif all went well
TM_ECODE_FAILEDon serious errors

alert counter setup

Definition at line 3369 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCCalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectEngineThreadCtxInitForReload()

DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload ( ThreadVars *  tv,
DetectEngineCtx *  new_de_ctx,
int  mt 
)

alert counter setup

Definition at line 3452 of file detect-engine.c.

References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineReference(), SCCalloc, SCFree, DetectEngineCtx_::tenant_id, DetectEngineThreadCtx_::tenant_id, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.

Here is the call graph for this function:

◆ DetectEngineUnsetParseMetadata()

void DetectEngineUnsetParseMetadata ( void  )

Definition at line 4970 of file detect-engine.c.

◆ DetectGetMultiData()

InspectionBuffer* DetectGetMultiData ( struct DetectEngineThreadCtx_ *  det_ctx,
const DetectEngineTransforms *  transforms,
Flow *  f,
const uint8_t  flow_flags,
void *  txv,
const int  list_id,
uint32_t  index,
InspectionMultiBufferGetDataPtr  GetBuf 
)

Definition at line 2135 of file detect-engine.c.

References DETECT_CI_FLAGS_SINGLE, InspectionBuffer::flags, InspectionBuffer::initialized, InspectionBufferMultipleForListGet(), InspectionBufferSetupMulti(), and InspectionBufferSetupMultiEmpty().

Referenced by DetectEngineInspectMultiBufferGeneric().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectGetSingleData()

InspectionBuffer* DetectGetSingleData ( struct DetectEngineThreadCtx_ *  det_ctx,
const DetectEngineTransforms *  transforms,
Flow *  f,
const uint8_t  flow_flags,
void *  txv,
const int  list_id,
InspectionSingleBufferGetDataPtr  GetBuf 
)

Definition at line 2118 of file detect-engine.c.

References InspectionBuffer::inspect, InspectionBufferGet(), and InspectionBufferSetupAndApplyTransforms().

Referenced by DetectEngineInspectBufferSingle().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DetectMd5ValidateCallback()

bool DetectMd5ValidateCallback ( const Signature *  s,
const char **  sigerror,
const DetectBufferType *  map 
)

Definition at line 5015 of file detect-engine.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, DetectContentData_::content, DetectContentData_::content_len, SigMatch_::ctx, DETECT_CONTENT, DETECT_CONTENT_NOCASE, DetectContentData_::flags, SignatureInitDataBuffer_::head, DetectBufferType_::id, SignatureInitDataBuffer_::id, Signature_::id, Signature_::init_data, DetectBufferType_::name, SigMatch_::next, SCLogError, SCLogWarning, and SigMatch_::type.

◆ DetectPktInspectEngineRegister()

void DetectPktInspectEngineRegister ( const char *  name,
InspectionBufferGetPktDataPtr  GetPktData,
InspectionBufferPktInspectFunc  Callback 
)

register inspect engine at start up time

Note
errors are fatal

Definition at line 155 of file detect-engine.c.

References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, name, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.

Here is the call graph for this function:

◆ DetectRegisterThreadCtxGlobalFuncs()

int DetectRegisterThreadCtxGlobalFuncs ( const char *  name,
void *(*)(void *)  InitFunc,
void *  data,
void(*)(void *)  FreeFunc 
)

Register Thread keyword context Funcs (Global)

IDs stay static over reloads and between tenants

Parameters
namekeyword name for error printing
InitFuncfunction ptr
FreeFuncfunction ptr
Return values
idfor retrieval of ctx at runtime
-1on error

Definition at line 3753 of file detect-engine.c.

References BUG_ON, and id.

◆ DetectSigmatchListEnumToString()

const char* DetectSigmatchListEnumToString ( enum DetectSigmatchListEnum  type)

Definition at line 4980 of file detect-engine.c.

References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.

◆ DetectTableToString()

const char* DetectTableToString ( enum DetectTable  table)

Definition at line 130 of file detect-engine.c.

References DETECT_TABLE_APP_FILTER, DETECT_TABLE_APP_TD, DETECT_TABLE_NOT_SET, DETECT_TABLE_PACKET_FILTER, DETECT_TABLE_PACKET_PRE_FLOW, DETECT_TABLE_PACKET_PRE_STREAM, and DETECT_TABLE_PACKET_TD.

◆ DetectThreadCtxGetGlobalKeywordThreadCtx()

void* DetectThreadCtxGetGlobalKeywordThreadCtx ( DetectEngineThreadCtx *  det_ctx,
int  id 
)

Retrieve thread local keyword ctx by id.

Parameters
det_ctxdetection engine thread ctx to retrieve the ctx from
idid of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init.
Return values
ctxor NULL on error

Definition at line 3797 of file detect-engine.c.

References DetectEngineThreadCtx_::global_keyword_ctxs_array, DetectEngineThreadCtx_::global_keyword_ctxs_size, and id.

Referenced by HttpHeaderGetBufferSpace().

Here is the caller graph for this function:

◆ InjectPacketsForFlush()

void InjectPacketsForFlush ( ThreadVars **  detect_tvs,
int  no_of_detect_tvs 
)

Definition at line 2249 of file detect-engine.c.

References PacketQueue_::cond_q, Packet_::flags, PacketQueue_::mutex_q, name, PacketEnqueue(), PacketGetFromAlloc(), PKT_PSEUDO_LOG_FLUSH, PKT_PSEUDO_STREAM_END, PKT_SET_SRC, PKT_SRC_DETECT_RELOAD_FLUSH, SCCondSignal, SCLogDebug, SCMutexLock, SCMutexUnlock, and ThreadVars_::stream_pq.

Here is the call graph for this function: