suricata
|
Go to the source code of this file.
Macros | |
#define | DetectEngineGetMaxSigId(de_ctx) ((de_ctx)->signum) |
Definition in file detect-engine.h.
Definition at line 102 of file detect-engine.h.
void DetectAppLayerInspectEngineRegister2 | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectEngineFuncPtr2 | Callback2, | ||
InspectionBufferGetDataPtr | GetData | ||
) |
Registers an app inspection engine.
name | Name of the detection list |
alproto | App layer protocol for which we will register the engine. |
direction | The direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT |
progress | Minimal progress value for inspect engine to run |
Callback | The engine callback. |
Registers an app inspection engine.
Definition at line 224 of file detect-engine.c.
int DetectBufferGetActiveList | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 1306 of file detect-engine.c.
References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DETECT_SM_LIST_DYNAMIC_START, DETECT_SM_LIST_NOTSET, DetectEngineBufferTypeGetByIdTransforms(), Signature_::init_data, SignatureInitData_::list, SignatureInitData_::list_set, SCLogDebug, SCLogError, SCReturnInt, DetectEngineTransforms::transforms, and SignatureInitData_::transforms.
Referenced by DetectContentSetup().
int WARN_UNUSED DetectBufferSetActiveList | ( | Signature * | s, |
const int | list | ||
) |
Definition at line 1293 of file detect-engine.c.
void DetectBufferTypeCloseRegistration | ( | void | ) |
Definition at line 1669 of file detect-engine.c.
References BUG_ON.
Referenced by SigTableSetup().
int DetectBufferTypeGetByName | ( | const char * | name | ) |
Definition at line 1079 of file detect-engine.c.
Referenced by DetectEngineAppInspectionEngine2Signature(), DetectFrameInspectEngineRegister(), DetectFrameMpmRegister(), and DetectPktInspectEngineRegister().
const char* DetectBufferTypeGetDescriptionByName | ( | const char * | name | ) |
Definition at line 1196 of file detect-engine.c.
int DetectBufferTypeMaxId | ( | void | ) |
Definition at line 916 of file detect-engine.c.
Referenced by SigAlloc().
int DetectBufferTypeRegister | ( | const char * | name | ) |
Definition at line 1025 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameInspectEngineRegister(), and DetectPktInspectEngineRegister().
void DetectBufferTypeRegisterSetupCallback | ( | const char * | name, |
void(*)(const DetectEngineCtx *, Signature *) | Callback | ||
) |
Definition at line 1255 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeRegisterValidateCallback | ( | const char * | name, |
bool(*)(const Signature *, const char **sigerror) | ValidateCallback | ||
) |
Definition at line 1273 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSetDescriptionByName | ( | const char * | name, |
const char * | desc | ||
) |
Definition at line 1176 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsFrames | ( | const char * | name | ) |
Definition at line 1039 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsMpm | ( | const char * | name | ) |
Definition at line 1059 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsPacket | ( | const char * | name | ) |
Definition at line 1049 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsTransformations | ( | const char * | name | ) |
Definition at line 1069 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
int DetectEngineAddToMaster | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4344 of file detect-engine.c.
References de_ctx, and SCLogDebug.
int DetectEngineAppInspectionEngine2Signature | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 581 of file detect-engine.c.
References DetectEngineFrameInspectionEngine::alproto, Signature_::alproto, ALPROTO_UNKNOWN, de_ctx, DETECT_SM_LIST_DYNAMIC_START, DetectBufferTypeGetByName(), DetectEngineCtx_::frame_inspect_engines, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, SCLogDebug, SigMatchList2DataArray(), DetectEngineFrameInspectionEngine::sm_list, SignatureInitData_::smlists, and SignatureInitData_::smlists_array_size.
void DetectEngineAppInspectionEngineSignatureFree | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
free app inspect engines for a signature
For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.
Definition at line 837 of file detect-engine.c.
References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, MAX, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::sm_list, DetectEnginePktInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.
void DetectEngineBufferRunSetupCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
Signature * | s | ||
) |
Definition at line 1265 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.
bool DetectEngineBufferRunValidateCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
const Signature * | s, | ||
const char ** | sigerror | ||
) |
Definition at line 1283 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::ValidateCallback.
const DetectBufferType* DetectEngineBufferTypeGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1099 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_hash_id, de_ctx, HashListTableLookup(), and DetectBufferType_::id.
Referenced by DetectEngineBufferRunSetupCallback(), DetectEngineBufferRunValidateCallback(), DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeGetDescriptionById(), DetectEngineBufferTypeGetNameById(), DetectEngineBufferTypeSupportsMpmGetById(), DetectEngineBufferTypeSupportsPacketGetById(), and DetectEngineBufferTypeValidateTransform().
int DetectEngineBufferTypeGetByIdTransforms | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
TransformData * | transforms, | ||
int | transform_cnt | ||
) |
Definition at line 1676 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_hash_id, DetectEngineCtx_::buffer_type_hash_name, DetectEngineCtx_::buffer_type_id, BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectAppLayerMpmRegisterByParentId(), DetectEngineBufferTypeGetById(), DetectFrameMpmRegisterByParentId(), DetectPktMpmRegisterByParentId(), DetectBufferType_::frame, HashListTableAdd(), HashListTableLookup(), DetectBufferType_::id, DetectBufferType_::mpm, DetectBufferType_::name, DetectBufferType_::packet, DetectBufferType_::parent_id, SCCalloc, SCLogDebug, SCLogError, DetectBufferType_::SetupCallback, strlcpy(), DetectBufferType_::supports_transforms, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and DetectBufferType_::ValidateCallback.
Referenced by DetectBufferGetActiveList().
const char* DetectEngineBufferTypeGetDescriptionById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1187 of file detect-engine.c.
References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().
const char* DetectEngineBufferTypeGetNameById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1109 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.
Referenced by DumpPatterns(), EngineAnalysisRules2(), and SignatureIsIPOnly().
int DetectEngineBufferTypeRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1166 of file detect-engine.c.
Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().
int DetectEngineBufferTypeRegisterWithFrameEngines | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
const int | direction, | ||
const AppProto | alproto, | ||
const uint8_t | frame_type | ||
) |
Definition at line 1132 of file detect-engine.c.
void DetectEngineBufferTypeSupportsFrames | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1205 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
void DetectEngineBufferTypeSupportsMpm | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1221 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeSupportsMpmGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1246 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.
Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().
void DetectEngineBufferTypeSupportsPacket | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1213 of file detect-engine.c.
bool DetectEngineBufferTypeSupportsPacketGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1237 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.
void DetectEngineBufferTypeSupportsTransformations | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1229 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeValidateTransform | ( | DetectEngineCtx * | de_ctx, |
int | sm_list, | ||
const uint8_t * | content, | ||
uint16_t | content_len, | ||
const char ** | namestr | ||
) |
Check content byte array compatibility with transforms.
The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.
When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first positive validation result terminates the loop.
de_ctx | Detection engine context. |
sm_list | The SM list id. |
content | The byte array being validated |
namestr | returns the name of the transform that is incompatible with content. |
true | (false) If any of the transforms indicate the byte array is (is not) compatible. |
Definition at line 1538 of file detect-engine.c.
References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.
Referenced by DetectContentSetup().
void DetectEngineBumpVersion | ( | void | ) |
Definition at line 3614 of file detect-engine.c.
void DetectEngineCtxFree | ( | DetectEngineCtx * | de_ctx | ) |
Free a DetectEngineCtx::
de_ctx | DetectEngineCtx:: to be freed |
Definition at line 2455 of file detect-engine.c.
References de_ctx, DetectEngineFreeFastPatternList(), DetectParseDupSigHashFree(), MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_ctx, DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingRuleDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::spm_global_thread_ctx, SpmDestroyGlobalThreadCtx(), and ThresholdContextDestroy().
DetectEngineCtx* DetectEngineCtxInit | ( | void | ) |
Definition at line 2416 of file detect-engine.c.
Referenced by DetectEngineCtxInitWithPrefix().
DetectEngineCtx* DetectEngineCtxInitStubForDD | ( | void | ) |
Definition at line 2411 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitStubForMT | ( | void | ) |
Definition at line 2406 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitWithPrefix | ( | const char * | prefix | ) |
Definition at line 2421 of file detect-engine.c.
References DetectEngineCtxInit().
void DetectEngineDeReference | ( | DetectEngineCtx ** | de_ctx | ) |
Definition at line 4320 of file detect-engine.c.
int DetectEngineEnabled | ( | void | ) |
Check if detection is enabled.
bool | true or false |
Definition at line 3590 of file detect-engine.c.
void DetectEngineFrameInspectEngineRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
int | dir, | ||
InspectionBufferFrameInspectFunc | Callback, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
register inspect engine at start up time
Definition at line 416 of file detect-engine.c.
References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, de_ctx, DETECT_SM_LIST_MATCH, DetectEngineBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, DetectEngineCtx_::frame_inspect_engines, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.
bool DetectEngineFrameInspectionRun | ( | ThreadVars * | tv, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p, | ||
uint8_t * | alert_flags | ||
) |
DetectEngineCtx* DetectEngineGetByTenantId | ( | int | tenant_id | ) |
Definition at line 4294 of file detect-engine.c.
DetectEngineCtx* DetectEngineGetCurrent | ( | void | ) |
Definition at line 3623 of file detect-engine.c.
Referenced by DetectEngineThreadCtxInit().
uint32_t DetectEngineGetVersion | ( | void | ) |
Definition at line 3604 of file detect-engine.c.
References version.
uint8_t DetectEngineInspectBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match. |
1 | match. |
2 | Sig can't match. |
Definition at line 2004 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), DetectEngineThreadCtx_::buffer_offset, de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.
uint8_t DetectEngineInspectGenericList | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const struct DetectEngineAppInspectionEngine_ * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
sm | SigMatch to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match |
1 | match |
Definition at line 1961 of file detect-engine.c.
References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.
int DetectEngineInspectPktBufferGeneric | ( | DetectEngineThreadCtx * | det_ctx, |
const DetectEnginePktInspectionEngine * | engine, | ||
const Signature * | s, | ||
Packet * | p, | ||
uint8_t * | _alert_flags | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
p | Packet |
0 | no match. |
1 | match. |
Definition at line 2067 of file detect-engine.c.
References DetectEngineThreadCtx_::buffer_offset, DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectEngineThreadCtx_::discontinue_matching, InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEngineThreadCtx_::inspection_recursion_counter, DetectEnginePktInspectionEngine::mpm, offset, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectEngineLoadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml | ||
) |
Load a tenant and wait for loading to complete.
Definition at line 3848 of file detect-engine.c.
int DetectEngineMoveToFreeList | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4360 of file detect-engine.c.
int DetectEngineMTApply | ( | void | ) |
Definition at line 4561 of file detect-engine.c.
int DetectEngineMultiTenantEnabled | ( | void | ) |
TODO locking? Not needed if this is a one time setting at startup
Definition at line 3655 of file detect-engine.c.
int DetectEngineMultiTenantSetup | ( | const bool | unix_socket | ) |
setup multi-detect / multi-tenancy
See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.
Definition at line 3997 of file detect-engine.c.
References TENANT_SELECTOR_UNKNOWN.
int DetectEngineMustParseMetadata | ( | void | ) |
Definition at line 4626 of file detect-engine.c.
Referenced by DetectMetadataHashInit().
bool DetectEnginePktInspectionRun | ( | ThreadVars * | tv, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p, | ||
uint8_t * | alert_flags | ||
) |
Definition at line 1819 of file detect-engine.c.
References Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, and SCLogDebug.
int DetectEnginePktInspectionSetup | ( | Signature * | s | ) |
Definition at line 1867 of file detect-engine.c.
References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.
void DetectEnginePruneFreeList | ( | void | ) |
Definition at line 4411 of file detect-engine.c.
DetectEngineCtx* DetectEngineReference | ( | DetectEngineCtx * | ) |
Definition at line 3646 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::ref_cnt.
Referenced by DetectEngineThreadCtxInitForReload().
void DetectEngineRegisterTests | ( | void | ) |
Definition at line 4891 of file detect-engine.c.
References UtRegisterTest().
int DetectEngineReload | ( | const SCInstance * | suri | ) |
Reload the detection engine.
filename | YAML file to load for the detect config |
-1 | error |
0 | ok |
Definition at line 4450 of file detect-engine.c.
References SCInstance_::conf_filename, and SCLogNotice.
int DetectEngineReloadIsIdle | ( | void | ) |
Definition at line 1937 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadIsStart | ( | void | ) |
Definition at line 1917 of file detect-engine.c.
References SCMutexLock.
void DetectEngineReloadSetIdle | ( | void | ) |
Definition at line 1929 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadStart | ( | void | ) |
Definition at line 1903 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml, | ||
int | reload_cnt | ||
) |
Reload a tenant and wait for loading to complete.
Definition at line 3862 of file detect-engine.c.
void DetectEngineResetMaxSigId | ( | DetectEngineCtx * | ) |
Definition at line 2837 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::signum.
Referenced by SigCleanSignatures().
void DetectEngineSetParseMetadata | ( | void | ) |
Definition at line 4616 of file detect-engine.c.
int DetectEngineTentantRegisterLivedev | ( | uint32_t | tenant_id, |
int | device_id | ||
) |
Definition at line 4262 of file detect-engine.c.
int DetectEngineTentantRegisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4277 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTentantRegisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4267 of file detect-engine.c.
int DetectEngineTentantUnregisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4283 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTentantUnregisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4272 of file detect-engine.c.
TmEcode DetectEngineThreadCtxDeinit | ( | ThreadVars * | , |
void * | |||
) |
Definition at line 3380 of file detect-engine.c.
References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SCLogWarning, and TM_ECODE_OK.
Referenced by DetectEngineThreadCtxInit().
TmEcode DetectEngineThreadCtxInit | ( | ThreadVars * | tv, |
void * | initdata, | ||
void ** | data | ||
) |
initialize thread specific detection engine context
tv | ThreadVars for this thread |
initdata | pointer to de_ctx |
data[out] | pointer to store our thread detection ctx |
TM_ECODE_OK | if all went well |
TM_ECODE_FAILED | on serious errors |
alert counter setup
Definition at line 3166 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCMalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload | ( | ThreadVars * | tv, |
DetectEngineCtx * | new_de_ctx, | ||
int | mt | ||
) |
alert counter setup
Definition at line 3231 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineReference(), SCFree, SCMalloc, DetectEngineCtx_::tenant_id, DetectEngineThreadCtx_::tenant_id, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
void DetectEngineUnsetParseMetadata | ( | void | ) |
Definition at line 4621 of file detect-engine.c.
void DetectFrameInspectEngineRegister | ( | const char * | name, |
int | dir, | ||
InspectionBufferFrameInspectFunc | Callback, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
register inspect engine at start up time
Definition at line 177 of file detect-engine.c.
References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.
void DetectPktInspectEngineRegister | ( | const char * | name, |
InspectionBufferGetPktDataPtr | GetPktData, | ||
InspectionBufferPktInspectFunc | Callback | ||
) |
register inspect engine at start up time
Definition at line 136 of file detect-engine.c.
References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectRegisterThreadCtxGlobalFuncs | ( | const char * | name, |
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc | ||
) |
Register Thread keyword context Funcs (Global)
IDs stay static over reloads and between tenants
name | keyword name for error printing |
InitFunc | function ptr |
FreeFunc | function ptr |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 3534 of file detect-engine.c.
References BUG_ON.
void DetectRunStoreStateTxFileOnly | ( | const SigGroupHead * | sgh, |
Flow * | f, | ||
void * | tx, | ||
uint64_t | tx_id, | ||
const uint8_t | flow_flags, | ||
const uint16_t | file_no_match | ||
) |
const char* DetectSigmatchListEnumToString | ( | enum DetectSigmatchListEnum | type | ) |
Definition at line 4631 of file detect-engine.c.
References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.
void* DetectThreadCtxGetGlobalKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3578 of file detect-engine.c.
References DetectEngineThreadCtx_::global_keyword_ctxs_array, and DetectEngineThreadCtx_::global_keyword_ctxs_size.
Referenced by HttpHeaderGetBufferSpace().
void InspectionBufferApplyTransforms | ( | InspectionBuffer * | buffer, |
const DetectEngineTransforms * | transforms | ||
) |
Definition at line 1563 of file detect-engine.c.
References BUG_ON, DETECT_TRANSFORMS_MAX, TransformData_::options, SCLogDebug, sigmatch_table, TransformData_::transform, SigTableElmt_::Transform, and DetectEngineTransforms::transforms.
Referenced by InspectionBufferSetupMulti(), Ja3DetectGetHash(), and Ja3DetectGetString().
void InspectionBufferCheckAndExpand | ( | InspectionBuffer * | buffer, |
uint32_t | min_size | ||
) |
make sure that the buffer has at least 'min_size' bytes Expand the buffer if necessary
Definition at line 1490 of file detect-engine.c.
References InspectionBuffer::buf, likely, SCRealloc, and InspectionBuffer::size.
Referenced by FileSwfDecompression(), and InspectionBufferCopy().
void InspectionBufferClean | ( | DetectEngineThreadCtx * | det_ctx | ) |
Definition at line 1336 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, InspectionBufferMultipleForList::init, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBufferMultipleForList::inspection_buffers, InspectionBufferMultipleForList::max, DetectEngineThreadCtx_::multi_inspect, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
void InspectionBufferCopy | ( | InspectionBuffer * | buffer, |
uint8_t * | buf, | ||
uint32_t | buf_len | ||
) |
Definition at line 1507 of file detect-engine.c.
References InspectionBuffer::buf, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferCheckAndExpand(), MIN, and InspectionBuffer::size.
Referenced by Ja3DetectGetHash().
void InspectionBufferFree | ( | InspectionBuffer * | buffer | ) |
Definition at line 1478 of file detect-engine.c.
References InspectionBuffer::buf, and SCFree.
InspectionBuffer* InspectionBufferGet | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id | ||
) |
Definition at line 1364 of file detect-engine.c.
References DetectEngineThreadCtx_::buffers, and DetectEngineThreadCtx_::inspect.
Referenced by InspectionBufferSetup(), Ja3DetectGetHash(), and Ja3DetectGetString().
void InspectionBufferInit | ( | InspectionBuffer * | buffer, |
uint32_t | initial_size | ||
) |
Definition at line 1421 of file detect-engine.c.
References InspectionBuffer::buf, SCCalloc, and InspectionBuffer::size.
InspectionBuffer* InspectionBufferMultipleForListGet | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id, | ||
const uint32_t | local_id | ||
) |
for a InspectionBufferMultipleForList get a InspectionBuffer
fb | the multiple buffer array |
local_id | the index to get a buffer |
buffer | the inspect buffer or NULL in case of error |
Definition at line 1384 of file detect-engine.c.
References DETECT_EVENT_TOO_MANY_BUFFERS, DetectEngineSetEvent(), and unlikely.
void InspectionBufferSetup | ( | DetectEngineThreadCtx * | det_ctx, |
const int | list_id, | ||
InspectionBuffer * | buffer, | ||
const uint8_t * | data, | ||
const uint32_t | data_len | ||
) |
setup the buffer with our initial data
Definition at line 1459 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, DetectEngineThreadCtx_::inspect, InspectionBuffer::inspect_len, InspectionBufferGet(), InspectionBuffer::len, InspectionBuffer::orig, InspectionBuffer::orig_len, DetectEngineThreadCtx_::to_clear_idx, and DetectEngineThreadCtx_::to_clear_queue.
Referenced by Ja3DetectGetHash(), and Ja3DetectGetString().
void InspectionBufferSetupMulti | ( | InspectionBuffer * | buffer, |
const DetectEngineTransforms * | transforms, | ||
const uint8_t * | data, | ||
const uint32_t | data_len | ||
) |
setup the buffer with our initial data
Definition at line 1444 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBufferApplyTransforms(), InspectionBuffer::len, InspectionBuffer::orig, and InspectionBuffer::orig_len.
void InspectionBufferSetupMultiEmpty | ( | InspectionBuffer * | buffer | ) |
setup the buffer empty
Definition at line 1431 of file detect-engine.c.
References DEBUG_VALIDATE_BUG_ON, InspectionBuffer::initialized, InspectionBuffer::inspect, InspectionBuffer::inspect_len, and InspectionBuffer::len.