suricata
|
Go to the source code of this file.
Macros | |
#define | DetectEngineGetMaxSigId(de_ctx) ((de_ctx)->signum) |
Definition in file detect-engine.h.
Definition at line 94 of file detect-engine.h.
void DetectAppLayerInspectEngineRegister | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectEngineFuncPtr | Callback2, | ||
InspectionBufferGetDataPtr | GetData | ||
) |
Registers an app inspection engine.
name | Name of the detection list |
alproto | App layer protocol for which we will register the engine. |
direction | The direction for the engine: SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT |
progress | Minimal progress value for inspect engine to run |
Callback | The engine callback. |
Definition at line 272 of file detect-engine.c.
Referenced by DetectFileRegisterFileProtocols(), DetectRegisterAppLayerHookLists(), and SCDetectHelperBufferRegister().
void DetectAppLayerInspectEngineRegisterSingle | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectEngineFuncPtr | Callback2, | ||
InspectionSingleBufferGetDataPtr | GetData | ||
) |
Definition at line 294 of file detect-engine.c.
void DetectAppLayerMultiRegister | ( | const char * | name, |
AppProto | alproto, | ||
uint32_t | dir, | ||
int | progress, | ||
InspectionMultiBufferGetDataPtr | GetData, | ||
int | priority | ||
) |
Definition at line 2107 of file detect-engine.c.
bool DetectBufferIsPresent | ( | const Signature * | s, |
const uint32_t | buf_id | ||
) |
Definition at line 1511 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, SignatureInitDataBuffer_::id, and Signature_::init_data.
void DetectBufferTypeCloseRegistration | ( | void | ) |
Definition at line 1655 of file detect-engine.c.
References BUG_ON.
int DetectBufferTypeGetByName | ( | const char * | name | ) |
Definition at line 1277 of file detect-engine.c.
Referenced by DetectEngineAppInspectionEngine2Signature(), DetectFrameMpmRegister(), and DetectPktInspectEngineRegister().
const char* DetectBufferTypeGetDescriptionByName | ( | const char * | name | ) |
Definition at line 1394 of file detect-engine.c.
int DetectBufferTypeMaxId | ( | void | ) |
Definition at line 1034 of file detect-engine.c.
int DetectBufferTypeRegister | ( | const char * | name | ) |
Definition at line 1213 of file detect-engine.c.
References BUG_ON.
Referenced by DetectPktInspectEngineRegister(), and SCDetectHelperBufferRegister().
void DetectBufferTypeRegisterSetupCallback | ( | const char * | name, |
void(*)(const DetectEngineCtx *, Signature *) | Callback | ||
) |
Definition at line 1471 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeRegisterValidateCallback | ( | const char * | name, |
bool(*)(const Signature *, const char **sigerror, const DetectBufferType *) | ValidateCallback | ||
) |
Definition at line 1489 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSetDescriptionByName | ( | const char * | name, |
const char * | desc | ||
) |
Definition at line 1374 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsFrames | ( | const char * | name | ) |
Definition at line 1237 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsMpm | ( | const char * | name | ) |
Definition at line 1257 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
void DetectBufferTypeSupportsMultiInstance | ( | const char * | name | ) |
Definition at line 1227 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsPacket | ( | const char * | name | ) |
Definition at line 1247 of file detect-engine.c.
References BUG_ON.
void DetectBufferTypeSupportsTransformations | ( | const char * | name | ) |
Definition at line 1267 of file detect-engine.c.
References BUG_ON.
Referenced by DetectFrameMpmRegister().
int DetectEngineAddToMaster | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4662 of file detect-engine.c.
References de_ctx, and SCLogDebug.
int DetectEngineAppInspectionEngine2Signature | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
Definition at line 800 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, de_ctx, DE_STATE_FLAG_BASE, DetectBufferTypeGetByName(), DetectEngineBufferTypeGetById(), FatalError, DetectBufferType_::frame, DetectEngineCtx_::frame_inspect_engines, SignatureInitDataBuffer_::head, SignatureInitDataBuffer_::id, Signature_::id, Signature_::init_data, SignatureInitData_::mpm_sm, SignatureInitData_::mpm_sm_list, DetectEngineFrameInspectionEngine::next, SCLogDebug, SigMatchList2DataArray(), and DetectEngineFrameInspectionEngine::sm_list.
void DetectEngineAppInspectionEngineSignatureFree | ( | DetectEngineCtx * | de_ctx, |
Signature * | s | ||
) |
free app inspect engines for a signature
For lists that are registered multiple times, like http_header and http_cookie, making the engines owner of the lists is complicated. Multiple engines in a sig may be pointing to the same list. To address this the 'free' code needs to be extra careful about not double freeing, so it takes an approach to first fill an array of the to-free pointers before freeing them.
Definition at line 928 of file detect-engine.c.
References Signature_::app_inspect, BUG_ON, SigMatchData_::ctx, de_ctx, Signature_::frame_inspect, SigTableElmt_::Free, SigMatchData_::is_last, next, DetectEngineAppInspectionEngine_::next, DetectEnginePktInspectionEngine::next, DetectEngineFrameInspectionEngine::next, Signature_::pkt_inspect, SCFree, sigmatch_table, DetectEngineAppInspectionEngine_::smd, DetectEnginePktInspectionEngine::smd, DetectEngineFrameInspectionEngine::smd, and SigMatchData_::type.
void DetectEngineBufferRunSetupCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
Signature * | s | ||
) |
Definition at line 1481 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::SetupCallback.
bool DetectEngineBufferRunValidateCallback | ( | const DetectEngineCtx * | de_ctx, |
const int | id, | ||
const Signature * | s, | ||
const char ** | sigerror | ||
) |
Definition at line 1500 of file detect-engine.c.
References DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::transforms, and DetectBufferType_::ValidateCallback.
const DetectBufferType* DetectEngineBufferTypeGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1297 of file detect-engine.c.
References DetectEngineCtx_::buffer_type_hash_id, de_ctx, HashListTableLookup(), DetectBufferType_::id, and id.
Referenced by DetectEngineAppInspectionEngine2Signature(), DetectEngineBufferRunSetupCallback(), DetectEngineBufferRunValidateCallback(), DetectEngineBufferTypeGetByIdTransforms(), DetectEngineBufferTypeGetDescriptionById(), DetectEngineBufferTypeGetNameById(), DetectEngineBufferTypeSupportsFramesGetById(), DetectEngineBufferTypeSupportsMpmGetById(), DetectEngineBufferTypeSupportsMultiInstanceGetById(), DetectEngineBufferTypeSupportsPacketGetById(), and DetectEngineBufferTypeValidateTransform().
int DetectEngineBufferTypeGetByIdTransforms | ( | DetectEngineCtx * | de_ctx, |
const int | id, | ||
TransformData * | transforms, | ||
int | transform_cnt | ||
) |
Definition at line 1662 of file detect-engine.c.
References DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::name, SCLogDebug, SCLogError, strlcpy(), DetectBufferType_::supports_transforms, DetectEngineTransforms::transforms, and DetectBufferType_::transforms.
Referenced by DetectBufferGetActiveList().
const char* DetectEngineBufferTypeGetDescriptionById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1385 of file detect-engine.c.
References de_ctx, DetectBufferType_::description, and DetectEngineBufferTypeGetById().
Referenced by EngineAnalysisFP().
const char* DetectEngineBufferTypeGetNameById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1307 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), and DetectBufferType_::name.
Referenced by DumpPatterns(), EngineAnalysisFP(), and EngineAnalysisRules2().
int DetectEngineBufferTypeRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1364 of file detect-engine.c.
Referenced by DetectEngineFrameInspectEngineRegister(), and DetectEngineFrameMpmRegister().
int DetectEngineBufferTypeRegisterWithFrameEngines | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
const int | direction, | ||
const AppProto | alproto, | ||
const uint8_t | frame_type | ||
) |
Definition at line 1330 of file detect-engine.c.
void DetectEngineBufferTypeSupportsFrames | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1403 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeSupportsFramesGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1462 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::frame, and SCLogDebug.
void DetectEngineBufferTypeSupportsMpm | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1419 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeSupportsMpmGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1453 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::mpm, and SCLogDebug.
Referenced by DetectGetLastSMFromMpmLists(), and FastPatternSupportEnabledForSigMatchList().
bool DetectEngineBufferTypeSupportsMultiInstanceGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1435 of file detect-engine.c.
References BOOL2STR, de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::multi_instance, and SCLogDebug.
Referenced by DetectBufferGetActiveList().
void DetectEngineBufferTypeSupportsPacket | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1411 of file detect-engine.c.
bool DetectEngineBufferTypeSupportsPacketGetById | ( | const DetectEngineCtx * | de_ctx, |
const int | id | ||
) |
Definition at line 1444 of file detect-engine.c.
References de_ctx, DetectEngineBufferTypeGetById(), DetectBufferType_::packet, and SCLogDebug.
void DetectEngineBufferTypeSupportsTransformations | ( | DetectEngineCtx * | de_ctx, |
const char * | name | ||
) |
Definition at line 1427 of file detect-engine.c.
Referenced by DetectEngineFrameMpmRegister().
bool DetectEngineBufferTypeValidateTransform | ( | DetectEngineCtx * | de_ctx, |
int | sm_list, | ||
const uint8_t * | content, | ||
uint16_t | content_len, | ||
const char ** | namestr | ||
) |
Check content byte array compatibility with transforms.
The "content" array is presented to the transforms so that each transform may validate that it's compatible with the transform.
When a transform indicates the byte array is incompatible, none of the subsequent transforms, if any, are invoked. This means the first validation failure terminates the loop.
de_ctx | Detection engine context. |
sm_list | The SM list id. |
content | The byte array being validated |
namestr | returns the name of the transform that is incompatible with content. |
true | (false) If any of the transforms indicate the byte array is (is not) compatible. |
Definition at line 1539 of file detect-engine.c.
References BUG_ON, DetectEngineTransforms::cnt, de_ctx, DetectEngineBufferTypeGetById(), SigTableElmt_::name, TransformData_::options, sigmatch_table, TransformData_::transform, DetectEngineTransforms::transforms, DetectBufferType_::transforms, and SigTableElmt_::TransformValidate.
Referenced by DetectContentSetup().
void DetectEngineBumpVersion | ( | void | ) |
Definition at line 3836 of file detect-engine.c.
void DetectEngineClearMaster | ( | void | ) |
Definition at line 4762 of file detect-engine.c.
Referenced by GlobalsDestroy().
void DetectEngineCtxFree | ( | DetectEngineCtx * | de_ctx | ) |
Free a DetectEngineCtx::
de_ctx | DetectEngineCtx:: to be freed |
Definition at line 2641 of file detect-engine.c.
References MpmTableElmt_::ConfigDeinit, de_ctx, DetectEngineFreeFastPatternList(), DetectParseDupSigHashFree(), DetectEngineCtx_::filedata_config, DetectEngineCtx_::mpm_cfg, DetectEngineCtx_::mpm_matcher, mpm_table, MpmFactoryDeRegisterAllMpmCtxProfiles(), MpmStoreFree(), DetectEngineCtx_::profile_keyword_ctx, DetectEngineCtx_::profile_sgh_ctx, SCClassConfDeInitContext(), SCFree, SCProfilingKeywordDestroyCtx(), SCProfilingPrefilterDestroyCtx(), SCProfilingSghDestroyCtx(), SCRConfDeInitContext(), SCSigSignatureOrderingModuleCleanup(), DetectEngineCtx_::sig_array, SigCleanSignatures(), SigGroupCleanup(), SigGroupHeadHashFree(), DetectEngineCtx_::sm_types_prefilter, DetectEngineCtx_::sm_types_silent_error, DetectEngineCtx_::spm_global_thread_ctx, and SpmDestroyGlobalThreadCtx().
DetectEngineCtx* DetectEngineCtxInit | ( | void | ) |
Definition at line 2602 of file detect-engine.c.
Referenced by DetectEngineCtxInitWithPrefix().
DetectEngineCtx* DetectEngineCtxInitStubForDD | ( | void | ) |
Definition at line 2597 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitStubForMT | ( | void | ) |
Definition at line 2592 of file detect-engine.c.
DetectEngineCtx* DetectEngineCtxInitWithPrefix | ( | const char * | prefix, |
uint32_t | tenant_id | ||
) |
Definition at line 2607 of file detect-engine.c.
References DetectEngineCtxInit().
void DetectEngineDeReference | ( | DetectEngineCtx ** | de_ctx | ) |
Definition at line 4638 of file detect-engine.c.
References de_ctx, and DEBUG_VALIDATE_BUG_ON.
Referenced by GlobalsDestroy(), and SCDetectEngineRegisterRateFilterCallback().
int DetectEngineEnabled | ( | void | ) |
Check if detection is enabled.
bool | true or false |
Definition at line 3812 of file detect-engine.c.
void DetectEngineFrameInspectEngineRegister | ( | DetectEngineCtx * | de_ctx, |
const char * | name, | ||
int | dir, | ||
InspectionBufferFrameInspectFunc | Callback, | ||
AppProto | alproto, | ||
uint8_t | type | ||
) |
register inspect engine at start up time
Definition at line 450 of file detect-engine.c.
References DetectEngineFrameInspectionEngine::alproto, BUG_ON, DetectEngineFrameInspectionEngine::Callback, de_ctx, DETECT_SM_LIST_MATCH, DetectEngineBufferTypeRegister(), DetectEngineFrameInspectionEngine::dir, FatalError, DetectEngineCtx_::frame_inspect_engines, name, SCCalloc, SCLogError, SIG_FLAG_TOSERVER, DetectEngineFrameInspectionEngine::sm_list, DetectEngineFrameInspectionEngine::sm_list_base, type, DetectEngineFrameInspectionEngine::type, unlikely, and DetectEngineFrameInspectionEngine::v1.
DetectEngineCtx* DetectEngineGetByTenantId | ( | uint32_t | tenant_id | ) |
Definition at line 4612 of file detect-engine.c.
DetectEngineCtx* DetectEngineGetCurrent | ( | void | ) |
Definition at line 3845 of file detect-engine.c.
Referenced by DetectEngineThreadCtxInit(), GlobalsDestroy(), and SCDetectEngineRegisterRateFilterCallback().
uint32_t DetectEngineGetVersion | ( | void | ) |
Definition at line 3826 of file detect-engine.c.
References version.
uint8_t DetectEngineInspectBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match. |
1 | match. |
2 | Sig can't match. |
Definition at line 2057 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.
uint8_t DetectEngineInspectBufferSingle | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match. |
1 | match. |
2 | Sig can't match. |
Definition at line 1996 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), DetectGetSingleData(), flags, InspectionBuffer::flags, DetectEngineAppInspectionEngine_::GetDataSingle, InspectionBuffer::inspect, InspectionBuffer::inspect_len, InspectionBuffer::inspect_offset, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, offset, DetectEngineAppInspectionEngine_::progress, Flow_::proto, SCLogDebug, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, unlikely, and DetectEngineAppInspectionEngine_::v2.
uint8_t DetectEngineInspectGenericList | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const struct DetectEngineAppInspectionEngine_ * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
sm | SigMatch to inspect |
f | Flow |
flags | app layer flags |
state | App layer state |
0 | no match |
1 | match |
Definition at line 1954 of file detect-engine.c.
References SigMatchData_::ctx, DETECT_ENGINE_INSPECT_SIG_CANT_MATCH, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, flags, SigMatchData_::is_last, KEYWORD_PROFILING_END, KEYWORD_PROFILING_START, SCLogDebug, sigmatch_table, DetectEngineAppInspectionEngine_::smd, and SigMatchData_::type.
Referenced by DetectRegisterAppLayerHookLists(), and SCDetectHelperBufferRegister().
uint8_t DetectEngineInspectMultiBufferGeneric | ( | DetectEngineCtx * | de_ctx, |
DetectEngineThreadCtx * | det_ctx, | ||
const DetectEngineAppInspectionEngine * | engine, | ||
const Signature * | s, | ||
Flow * | f, | ||
uint8_t | flags, | ||
void * | alstate, | ||
void * | txv, | ||
uint64_t | tx_id | ||
) |
Definition at line 2157 of file detect-engine.c.
References Flow_::alproto, AppLayerParserGetStateProgress(), de_ctx, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspectionBuffer(), DetectGetMultiData(), flags, DetectEngineAppInspectionEngine_::GetMultiData, InspectionBuffer::inspect, DetectEngineAppInspectionEngine_::match_on_null, DetectEngineAppInspectionEngine_::mpm, DetectEngineAppInspectionEngine_::progress, Flow_::proto, DetectEngineAppInspectionEngine_::sm_list, DetectEngineAppInspectionEngine_::smd, DetectEngineAppInspectionEngine_::transforms, and DetectEngineAppInspectionEngine_::v2.
int DetectEngineInspectPktBufferGeneric | ( | DetectEngineThreadCtx * | det_ctx, |
const DetectEnginePktInspectionEngine * | engine, | ||
const Signature * | s, | ||
Packet * | p, | ||
uint8_t * | _alert_flags | ||
) |
Do the content inspection & validation for a signature.
de_ctx | Detection engine context |
det_ctx | Detection engine thread context |
s | Signature to inspect |
p | Packet |
0 | no match. |
1 | match. |
Definition at line 2205 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_CI_FLAGS_END, DETECT_CI_FLAGS_START, DETECT_ENGINE_CONTENT_INSPECTION_MODE_HEADER, DETECT_ENGINE_INSPECT_SIG_MATCH, DETECT_ENGINE_INSPECT_SIG_NO_MATCH, DetectEngineContentInspection(), InspectionBuffer::flags, Packet_::flow, DetectEnginePktInspectionEngine::GetData, InspectionBuffer::inspect, InspectionBuffer::inspect_len, DetectEnginePktInspectionEngine::mpm, SCLogDebug, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::smd, DetectEnginePktInspectionEngine::transforms, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectEngineLoadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml | ||
) |
Load a tenant and wait for loading to complete.
Definition at line 4136 of file detect-engine.c.
int DetectEngineMoveToFreeList | ( | DetectEngineCtx * | de_ctx | ) |
Definition at line 4722 of file detect-engine.c.
Referenced by GlobalsDestroy().
bool DetectEngineMpmCachingEnabled | ( | void | ) |
Definition at line 2462 of file detect-engine.c.
References SCConfGetBool().
Referenced by DetectEngineMpmCachingGetPath().
const char* DetectEngineMpmCachingGetPath | ( | void | ) |
Definition at line 2471 of file detect-engine.c.
References DetectEngineMpmCachingEnabled(), SCConfGet(), and SCLogInfo.
int DetectEngineMTApply | ( | void | ) |
Definition at line 4913 of file detect-engine.c.
bool DetectEngineMultiTenantEnabled | ( | void | ) |
Definition at line 3876 of file detect-engine.c.
int DetectEngineMultiTenantSetup | ( | const bool | unix_socket | ) |
setup multi-detect / multi-tenancy
See if MT is enabled. If so, setup the selector, tenants and mappings. Tenants and mappings are optional, and can also dynamically be added and removed from the unix socket.
Definition at line 4299 of file detect-engine.c.
References TENANT_SELECTOR_UNKNOWN.
int DetectEngineMustParseMetadata | ( | void | ) |
Definition at line 4980 of file detect-engine.c.
Referenced by DetectMetadataHashInit().
bool DetectEnginePktInspectionRun | ( | ThreadVars * | tv, |
DetectEngineThreadCtx * | det_ctx, | ||
const Signature * | s, | ||
Flow * | f, | ||
Packet * | p, | ||
uint8_t * | alert_flags | ||
) |
Definition at line 1812 of file detect-engine.c.
References DetectEnginePktInspectionEngine::Callback, DETECT_ENGINE_INSPECT_SIG_MATCH, Signature_::id, DetectEnginePktInspectionEngine::next, Signature_::pkt_inspect, SCEnter, SCLogDebug, and DetectEnginePktInspectionEngine::v1.
int DetectEnginePktInspectionSetup | ( | Signature * | s | ) |
Definition at line 1860 of file detect-engine.c.
References DETECT_SM_LIST_PMATCH, Signature_::init_data, SignatureInitData_::init_flags, SIG_FLAG_INIT_STATE_MATCH, and Signature_::sm_arrays.
void DetectEnginePruneFreeList | ( | void | ) |
Definition at line 4732 of file detect-engine.c.
DetectEngineCtx* DetectEngineReference | ( | DetectEngineCtx * | ) |
Definition at line 3868 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::ref_cnt.
Referenced by DetectEngineThreadCtxInitForReload().
void DetectEngineRegisterTests | ( | void | ) |
Definition at line 5295 of file detect-engine.c.
References UtRegisterTest().
int DetectEngineReload | ( | const SCInstance * | suri | ) |
Reload the detection engine.
filename | YAML file to load for the detect config |
-1 | error |
0 | ok |
Definition at line 4789 of file detect-engine.c.
References SCInstance_::conf_filename, and SCLogNotice.
Referenced by SuricataMainLoop().
int DetectEngineReloadIsIdle | ( | void | ) |
Definition at line 1930 of file detect-engine.c.
References SCMutexLock.
int DetectEngineReloadIsStart | ( | void | ) |
Definition at line 1910 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
void DetectEngineReloadSetIdle | ( | void | ) |
Definition at line 1922 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
int DetectEngineReloadStart | ( | void | ) |
Definition at line 1896 of file detect-engine.c.
References SCMutexLock.
Referenced by SuricataMainLoop().
int DetectEngineReloadTenantBlocking | ( | uint32_t | tenant_id, |
const char * | yaml, | ||
int | reload_cnt | ||
) |
Reload a tenant and wait for loading to complete.
Definition at line 4150 of file detect-engine.c.
int DetectEngineReloadTenantsBlocking | ( | const int | reload_cnt | ) |
Reload all tenants and wait for loading to complete.
Definition at line 4164 of file detect-engine.c.
void DetectEngineResetMaxSigId | ( | DetectEngineCtx * | ) |
Definition at line 3053 of file detect-engine.c.
References de_ctx, and DetectEngineCtx_::signum.
Referenced by SigCleanSignatures().
void DetectEngineSetParseMetadata | ( | void | ) |
Definition at line 4970 of file detect-engine.c.
int DetectEngineTenantRegisterLivedev | ( | uint32_t | tenant_id, |
int | device_id | ||
) |
Definition at line 4579 of file detect-engine.c.
int DetectEngineTenantRegisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4595 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTenantRegisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4585 of file detect-engine.c.
int DetectEngineTenantUnregisterPcapFile | ( | uint32_t | tenant_id | ) |
Definition at line 4601 of file detect-engine.c.
References SCLogInfo, and TENANT_SELECTOR_DIRECT.
int DetectEngineTenantUnregisterVlanId | ( | uint32_t | tenant_id, |
uint16_t | vlan_id | ||
) |
Definition at line 4590 of file detect-engine.c.
TmEcode DetectEngineThreadCtxDeinit | ( | ThreadVars * | , |
void * | |||
) |
Definition at line 3608 of file detect-engine.c.
References HashTableFree(), DetectEngineThreadCtx_::mt_det_ctxs_hash, SCLogWarning, and TM_ECODE_OK.
Referenced by DetectEngineThreadCtxInit(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
int DetectEngineThreadCtxGetJsonContext | ( | DetectEngineThreadCtx * | det_ctx | ) |
Definition at line 5069 of file detect-engine.c.
References DetectEngineThreadCtx_::json_content, DetectEngineThreadCtx_::json_content_capacity, DetectEngineThreadCtx_::json_content_len, SCLogDebug, SCRealloc, SIG_JSON_CONTENT_ARRAY_LEN, and unlikely.
TmEcode DetectEngineThreadCtxInit | ( | ThreadVars * | tv, |
void * | initdata, | ||
void ** | data | ||
) |
initialize thread specific detection engine context
tv | ThreadVars for this thread |
initdata | pointer to de_ctx |
data[out] | pointer to store our thread detection ctx |
TM_ECODE_OK | if all went well |
TM_ECODE_FAILED | on serious errors |
alert counter setup
Definition at line 3372 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineGetCurrent(), DetectEngineThreadCtxDeinit(), RunmodeIsUnittests(), SCCalloc, TM_ECODE_FAILED, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().
DetectEngineThreadCtx* DetectEngineThreadCtxInitForReload | ( | ThreadVars * | tv, |
DetectEngineCtx * | new_de_ctx, | ||
int | mt | ||
) |
alert counter setup
Definition at line 3455 of file detect-engine.c.
References DetectEngineThreadCtx_::de_ctx, DETECT_ENGINE_TYPE_NORMAL, DETECT_ENGINE_TYPE_TENANT, DetectEngineReference(), SCCalloc, SCFree, DetectEngineCtx_::tenant_id, DetectEngineThreadCtx_::tenant_id, tv, DetectEngineThreadCtx_::tv, DetectEngineCtx_::type, and unlikely.
void DetectEngineUnsetParseMetadata | ( | void | ) |
Definition at line 4975 of file detect-engine.c.
InspectionBuffer* DetectGetMultiData | ( | struct DetectEngineThreadCtx_ * | det_ctx, |
const DetectEngineTransforms * | transforms, | ||
Flow * | f, | ||
const uint8_t | flow_flags, | ||
void * | txv, | ||
const int | list_id, | ||
uint32_t | index, | ||
InspectionMultiBufferGetDataPtr | GetBuf | ||
) |
Definition at line 2133 of file detect-engine.c.
References DETECT_CI_FLAGS_SINGLE, InspectionBuffer::flags, InspectionBuffer::initialized, InspectionBufferMultipleForListGet(), InspectionBufferSetupMulti(), and InspectionBufferSetupMultiEmpty().
Referenced by DetectEngineInspectMultiBufferGeneric().
InspectionBuffer* DetectGetSingleData | ( | struct DetectEngineThreadCtx_ * | det_ctx, |
const DetectEngineTransforms * | transforms, | ||
Flow * | f, | ||
const uint8_t | flow_flags, | ||
void * | txv, | ||
const int | list_id, | ||
InspectionSingleBufferGetDataPtr | GetBuf | ||
) |
Definition at line 2116 of file detect-engine.c.
References InspectionBuffer::inspect, InspectionBufferGet(), and InspectionBufferSetupAndApplyTransforms().
Referenced by DetectEngineInspectBufferSingle().
bool DetectMd5ValidateCallback | ( | const Signature * | s, |
const char ** | sigerror, | ||
const DetectBufferType * | map | ||
) |
Definition at line 5020 of file detect-engine.c.
References SignatureInitData_::buffer_index, SignatureInitData_::buffers, DetectContentData_::content, DetectContentData_::content_len, SigMatch_::ctx, DETECT_CONTENT, DETECT_CONTENT_NOCASE, DetectContentData_::flags, SignatureInitDataBuffer_::head, DetectBufferType_::id, SignatureInitDataBuffer_::id, Signature_::id, Signature_::init_data, DetectBufferType_::name, SigMatch_::next, SCLogError, SCLogWarning, and SigMatch_::type.
void DetectPktInspectEngineRegister | ( | const char * | name, |
InspectionBufferGetPktDataPtr | GetPktData, | ||
InspectionBufferPktInspectFunc | Callback | ||
) |
register inspect engine at start up time
Definition at line 155 of file detect-engine.c.
References BUG_ON, DetectEnginePktInspectionEngine::Callback, DETECT_SM_LIST_MATCH, DetectBufferTypeGetByName(), DetectBufferTypeRegister(), FatalError, DetectEnginePktInspectionEngine::GetData, name, SCCalloc, SCLogError, DetectEnginePktInspectionEngine::sm_list, DetectEnginePktInspectionEngine::sm_list_base, unlikely, and DetectEnginePktInspectionEngine::v1.
int DetectRegisterThreadCtxGlobalFuncs | ( | const char * | name, |
void *(*)(void *) | InitFunc, | ||
void * | data, | ||
void(*)(void *) | FreeFunc | ||
) |
Register Thread keyword context Funcs (Global)
IDs stay static over reloads and between tenants
name | keyword name for error printing |
InitFunc | function ptr |
FreeFunc | function ptr |
id | for retrieval of ctx at runtime |
-1 | on error |
Definition at line 3756 of file detect-engine.c.
const char* DetectSigmatchListEnumToString | ( | enum DetectSigmatchListEnum | type | ) |
Definition at line 4985 of file detect-engine.c.
References DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_MAX, DETECT_SM_LIST_PMATCH, DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_TMATCH, and type.
const char* DetectTableToString | ( | enum DetectTable | table | ) |
Definition at line 130 of file detect-engine.c.
References DETECT_TABLE_APP_FILTER, DETECT_TABLE_APP_TD, DETECT_TABLE_NOT_SET, DETECT_TABLE_PACKET_FILTER, DETECT_TABLE_PACKET_PRE_FLOW, DETECT_TABLE_PACKET_PRE_STREAM, and DETECT_TABLE_PACKET_TD.
void* DetectThreadCtxGetGlobalKeywordThreadCtx | ( | DetectEngineThreadCtx * | det_ctx, |
int | id | ||
) |
Retrieve thread local keyword ctx by id.
det_ctx | detection engine thread ctx to retrieve the ctx from |
id | id of the ctx returned by DetectRegisterThreadCtxInitFunc at keyword init. |
ctx | or NULL on error |
Definition at line 3800 of file detect-engine.c.
References DetectEngineThreadCtx_::global_keyword_ctxs_array, DetectEngineThreadCtx_::global_keyword_ctxs_size, and id.
Referenced by HttpHeaderGetBufferSpace().
void InjectPacketsForFlush | ( | ThreadVars ** | detect_tvs, |
int | no_of_detect_tvs | ||
) |
Definition at line 2247 of file detect-engine.c.
References PacketQueue_::cond_q, Packet_::flags, PacketQueue_::mutex_q, name, PacketEnqueue(), PacketGetFromAlloc(), PKT_PSEUDO_LOG_FLUSH, PKT_PSEUDO_STREAM_END, PKT_SET_SRC, PKT_SRC_DETECT_RELOAD_FLUSH, SCCondSignal, SCLogDebug, SCMutexLock, SCMutexUnlock, and ThreadVars_::stream_pq.