detect-flowbits.c File Reference

#include "suricata-common.h"
#include "decode.h"
#include "action-globals.h"
#include "detect.h"
#include "threads.h"
#include "flow.h"
#include "flow-bit.h"
#include "flow-util.h"
#include "detect-flowbits.h"
#include "util-spm.h"
#include "rust.h"
#include "app-layer-parser.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-build.h"
#include "detect-engine-prefilter.h"
#include "tree.h"
#include "util-enum.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "util-conf.h"

Include dependency graph for detect-flowbits.c:

Go to the source code of this file.

Data Structures
struct	PrefilterFlowbit
struct	PrefilterEngineFlowbits

Macros
#define	PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"
#define	MAX_TOKENS   100
#define	MAX_IIDS   8
#define	BLOCK_SIZE   8

Functions
int	DetectFlowbitMatch (DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
void	DetectFlowbitFree (DetectEngineCtx *, void *)
void	FlowBitsRegisterTests (void)
	this function registers unit tests for FlowBits More...
void	DetectFlowbitsRegister (void)
void	FBAnalyzerFree (struct FBAnalyzer *fba)
int	DetectFlowbitsAnalyzeSignature (const Signature *s, struct FBAnalyzer *fba)
int	DetectFlowbitsAnalyze (DetectEngineCtx *de_ctx)
struct PrefilterFlowbit	__attribute__ ((__packed__))
	DNP3 link header. More...
	RB_HEAD (PFB, PrefilterFlowbit)
	RB_PROTOTYPE (PFB, PrefilterFlowbit, rb, PrefilterFlowbitCompare)
	RB_GENERATE (PFB, PrefilterFlowbit, rb, PrefilterFlowbitCompare)

Variables
SCEnumCharMap	flowbit_cmds []
bool	rule_engine_analysis_set
SCMutex	g_flowbits_dump_write_m = SCMUTEX_INITIALIZER
uint32_t *	rule_id
struct PrefilterEngineFlowbits	__attribute__

Detailed Description

Author

Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Breno Silva breno.nosp@m..sil.nosp@m.va@gm.nosp@m.ail..nosp@m.com

Implements the flowbits keyword

Definition in file detect-flowbits.c.

Macro Definition Documentation

BLOCK_SIZE

#define BLOCK_SIZE   8

Definition at line 1088 of file detect-flowbits.c.

MAX_IIDS

#define MAX_IIDS   8

Definition at line 522 of file detect-flowbits.c.

MAX_TOKENS

#define MAX_TOKENS   100

Definition at line 60 of file detect-flowbits.c.

PARSE_REGEX

#define PARSE_REGEX   "^([a-z]+)(?:,\\s*(.*))?"

Definition at line 57 of file detect-flowbits.c.

Function Documentation

DetectFlowbitFree()

void DetectFlowbitFree	(	DetectEngineCtx *	de_ctx,
		void *	ptr
	)

Definition at line 480 of file detect-flowbits.c.

References DetectFlowbitsData_::idx, DetectFlowbitsData_::or_list, DetectFlowbitsData_::or_list_size, SCFree, VAR_TYPE_FLOW_BIT, and VarNameStoreUnregister().

Here is the call graph for this function:

DetectFlowbitMatch()

int DetectFlowbitMatch	(	DetectEngineThreadCtx *	det_ctx,
		Packet *	p,
		const Signature *	s,
		const SigMatchCtx *	ctx
	)

Definition at line 290 of file detect-flowbits.c.

References DetectFlowbitsData_::cmd, ctx, and DETECT_FLOWBITS_CMD_ISSET.

Referenced by DetectFlowbitsRegister().

Here is the caller graph for this function:

DetectFlowbitsAnalyze()

int DetectFlowbitsAnalyze

(

DetectEngineCtx *

de_ctx

)

Definition at line 621 of file detect-flowbits.c.

References FBAnalyzer::array, FBAnalyzer::array_size, FBAnalyze::cnts, de_ctx, DETECT_FLOWBITS_CMD_ISNOTSET, DETECT_FLOWBITS_CMD_ISSET, DETECT_FLOWBITS_CMD_SET, DETECT_FLOWBITS_CMD_UNSET, DetectFlowbitsAnalyzeSignature(), FBAnalyzerFree(), Signature_::id, SigIdentifier_::iid, Signature_::init_data, SignatureInitData_::init_flags, SignatureInitData_::is_rule_state_dependant, FBAnalyze::isset_iids, FBAnalyze::isset_iids_idx, DetectEngineCtx_::max_fb_id, rule_engine_analysis_set, SignatureInitData_::rule_state_dependant_sids_array, SignatureInitData_::rule_state_dependant_sids_idx, SignatureInitData_::rule_state_dependant_sids_size, SignatureInitData_::rule_state_flowbits_ids_array, SignatureInitData_::rule_state_flowbits_ids_size, SCCalloc, SCLogDebug, SCLogError, SCLogWarning, SCRealloc, FBAnalyze::set_iids, FBAnalyze::set_iids_idx, DetectEngineCtx_::sig_array, DetectEngineCtx_::sig_array_len, SIG_FLAG_INIT_STATE_MATCH, FBAnalyze::state_cnts, VAR_TYPE_FLOW_BIT, and VarNameStoreSetupLookup().

Here is the call graph for this function:

DetectFlowbitsAnalyzeSignature()

int DetectFlowbitsAnalyzeSignature	(	const Signature *	s,
		struct FBAnalyzer *	fba
	)

Definition at line 537 of file detect-flowbits.c.

References FBAnalyzer::array, SignatureInitData_::buffer_index, DetectFlowbitsData_::cmd, FBAnalyze::cnts, DETECT_FLOWBITS, DETECT_FLOWBITS_CMD_ISSET, DETECT_SM_LIST_MATCH, Signature_::init_data, SigMatch_::next, DetectFlowbitsData_::or_list, DetectFlowbitsData_::or_list_size, SignatureInitData_::smlists, and FBAnalyze::state_cnts.

Referenced by DetectFlowbitsAnalyze().

Here is the caller graph for this function:

DetectFlowbitsRegister()

void DetectFlowbitsRegister

(

void

)

Definition at line 72 of file detect-flowbits.c.

References SigTableElmt_::desc, DETECT_FLOWBITS, DetectFlowbitMatch(), SigTableElmt_::Match, SigTableElmt_::name, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

FBAnalyzerFree()

void FBAnalyzerFree

(

struct FBAnalyzer *

fba

)

Definition at line 512 of file detect-flowbits.c.

References FBAnalyzer::array.

Referenced by DetectFlowbitsAnalyze().

Here is the caller graph for this function:

FlowBitsRegisterTests()

void FlowBitsRegisterTests

(

void

)

this function registers unit tests for FlowBits

Definition at line 1754 of file detect-flowbits.c.

References UtRegisterTest().

Here is the call graph for this function:

RB_GENERATE()

RB_GENERATE	(	PFB	,
		PrefilterFlowbit	,
		rb	,
		PrefilterFlowbitCompare
	)

RB_HEAD()

RB_HEAD	(	PFB	,
		PrefilterFlowbit
	)

red-black tree prototype for PFB (Prefilter Flow Bits)

RB_PROTOTYPE()

RB_PROTOTYPE	(	PFB	,
		PrefilterFlowbit	,
		rb	,
		PrefilterFlowbitCompare
	)

Variable Documentation

__attribute__

struct PrefilterEngineFlowbits __attribute__

flowbit_cmds

SCEnumCharMap flowbit_cmds[]

Initial value:

= {
    { "set", DETECT_FLOWBITS_CMD_SET },
    { "unset", DETECT_FLOWBITS_CMD_UNSET },
    { "isnotset", DETECT_FLOWBITS_CMD_ISNOTSET },
    { "isset", DETECT_FLOWBITS_CMD_ISSET },
}

Definition at line 107 of file detect-flowbits.c.

g_flowbits_dump_write_m

SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER

Definition at line 869 of file detect-flowbits.c.

rule_engine_analysis_set

bool rule_engine_analysis_set

Definition at line 58 of file detect-engine-loader.c.

Referenced by DetectFlowbitsAnalyze().

rule_id

uint32_t* rule_id

array of signature iid that are part of this prefilter

Definition at line 981 of file detect-flowbits.c.