detect-flowbits.c File Reference

#include "suricata-common.h"
#include "decode.h"
#include "action-globals.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-bit.h"
#include "flow-util.h"
#include "detect-flowbits.h"
#include "util-spm.h"
#include "rust.h"
#include "app-layer-parser.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-build.h"
#include "detect-engine-prefilter.h"
#include "tree.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "util-conf.h"

Include dependency graph for detect-flowbits.c:

Go to the source code of this file.

Data Structures
struct	FBAnalyzer
struct	FBAnalyze
struct	PrefilterFlowbit
struct	PrefilterEngineFlowbits

Macros
#define	PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"
#define	MAX_TOKENS   100
#define	MAX_SIDS   8
#define	BLOCK_SIZE   8

Functions
int	DetectFlowbitMatch (DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
void	DetectFlowbitFree (DetectEngineCtx *, void *)
void	FlowBitsRegisterTests (void)
	this function registers unit tests for FlowBits More...
void	DetectFlowbitsRegister (void)
int	DetectFlowbitsAnalyze (DetectEngineCtx *de_ctx)
struct PrefilterFlowbit	__attribute__ ((__packed__))
	DNP3 link header. More...
	RB_HEAD (PFB, PrefilterFlowbit)
	RB_PROTOTYPE (PFB, PrefilterFlowbit, rb, PrefilterFlowbitCompare)
	RB_GENERATE (PFB, PrefilterFlowbit, rb, PrefilterFlowbitCompare)

Variables
bool	rule_engine_analysis_set
SCMutex	g_flowbits_dump_write_m = SCMUTEX_INITIALIZER
uint32_t	id
uint32_t	rule_id_size
uint32_t	rule_id_cnt
uint32_t *	rule_id
struct PrefilterEngineFlowbits	__attribute__

Detailed Description

Author

Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com

Implements the flowbits keyword

Definition in file detect-flowbits.c.

Macro Definition Documentation

BLOCK_SIZE

#define BLOCK_SIZE   8

Definition at line 1045 of file detect-flowbits.c.

MAX_SIDS

#define MAX_SIDS   8

Definition at line 471 of file detect-flowbits.c.

MAX_TOKENS

#define MAX_TOKENS   100

Definition at line 59 of file detect-flowbits.c.

PARSE_REGEX

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"

Definition at line 56 of file detect-flowbits.c.

Function Documentation

DetectFlowbitFree()

void DetectFlowbitFree	(	DetectEngineCtx *	de_ctx,
		void *	ptr
	)

Definition at line 398 of file detect-flowbits.c.

References DetectFlowbitsData_::idx, DetectFlowbitsData_::or_list, DetectFlowbitsData_::or_list_size, SCFree, VAR_TYPE_FLOW_BIT, and VarNameStoreUnregister().

Here is the call graph for this function:

DetectFlowbitMatch()

int DetectFlowbitMatch	(	DetectEngineThreadCtx *	det_ctx,
		Packet *	p,
		const Signature *	s,
		const SigMatchCtx *	ctx
	)

Definition at line 206 of file detect-flowbits.c.

References DetectFlowbitsData_::cmd, ctx, and DETECT_FLOWBITS_CMD_ISSET.

Referenced by DetectFlowbitsRegister().

Here is the caller graph for this function:

DetectFlowbitsAnalyze()

int DetectFlowbitsAnalyze

(

DetectEngineCtx *

de_ctx

)

Definition at line 569 of file detect-flowbits.c.

References FBAnalyzer::array, FBAnalyzer::array_size, de_ctx, DetectEngineCtx_::max_fb_id, SCCalloc, SCLogDebug, SCLogError, DetectEngineCtx_::sig_array, and DetectEngineCtx_::sig_array_len.

DetectFlowbitsRegister()

void DetectFlowbitsRegister

(

void

)

Definition at line 71 of file detect-flowbits.c.

References SigTableElmt_::desc, DETECT_FLOWBITS, DetectFlowbitMatch(), SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

FlowBitsRegisterTests()

void FlowBitsRegisterTests

(

void

)

this function registers unit tests for FlowBits

Definition at line 1788 of file detect-flowbits.c.

References UtRegisterTest().

Here is the call graph for this function:

RB_GENERATE()

RB_GENERATE	(	PFB	,
		PrefilterFlowbit	,
		rb	,
		PrefilterFlowbitCompare
	)

RB_HEAD()

RB_HEAD	(	PFB	,
		PrefilterFlowbit
	)

red-black tree prototype for PFB (Prefilter Flow Bits)

RB_PROTOTYPE()

RB_PROTOTYPE	(	PFB	,
		PrefilterFlowbit	,
		rb	,
		PrefilterFlowbitCompare
	)

Variable Documentation

__attribute__

struct PrefilterEngineFlowbits __attribute__

g_flowbits_dump_write_m

SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER

Definition at line 816 of file detect-flowbits.c.

id

uint32_t id

flowbit id

Definition at line 938 of file detect-flowbits.c.

Referenced by DetectEngineBufferTypeGetById(), DetectRegisterThreadCtxGlobalFuncs(), DetectThreadCtxGetGlobalKeywordThreadCtx(), DetectThreadCtxGetKeywordThreadCtx(), OutputRegisterPacketModule(), OutputRegisterPacketSubModule(), PktVarAdd(), PoolThreadGetById(), PoolThreadLock(), PoolThreadReturn(), PoolThreadReturnRaw(), PoolThreadUnlock(), SCDetectHelperKeywordSetCleanCString(), SCProfilingKeywordUpdateCounter(), SCProfilingPrefilterUpdateCounter(), SigMatchSilentErrorEnabled(), StatsAddUI64(), StatsDecr(), StatsGetLocalCounterValue(), StatsIncr(), StatsSetUI64(), TmModuleGetById(), and TmqhGetQueueHandlerByID().

rule_engine_analysis_set

bool rule_engine_analysis_set

Definition at line 56 of file detect-engine-loader.c.

rule_id

uint32_t* rule_id

array of signature iid that are part of this prefilter

Definition at line 941 of file detect-flowbits.c.

rule_id_cnt

uint32_t rule_id_cnt

usage in elements of rule_id

Definition at line 940 of file detect-flowbits.c.

rule_id_size

uint32_t rule_id_size

size in elements of rule_id

Definition at line 939 of file detect-flowbits.c.