suricata
detect-hostbits.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements the hostbits keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 #include "action-globals.h"
29 #include "detect.h"
30 #include "threads.h"
31 #include "flow.h"
32 #include "flow-util.h"
33 #include "detect-hostbits.h"
34 #include "util-spm.h"
35 
36 #include "detect-engine-sigorder.h"
37 
38 #include "app-layer-parser.h"
39 
40 #include "detect-parse.h"
41 #include "detect-engine.h"
42 #include "detect-engine-mpm.h"
43 #include "detect-engine-state.h"
44 #include "detect-engine-build.h"
45 
46 #include "flow-bit.h"
47 #include "host-bit.h"
48 #include "util-var-name.h"
49 #include "util-unittest.h"
50 #include "util-debug.h"
51 
52 /*
53  hostbits:isset,bitname;
54  hostbits:set,bitname;
55 
56  hostbits:set,bitname,src;
57  hostbits:set,bitname,dst;
58 TODO:
59  hostbits:set,bitname,both;
60 
61  hostbits:set,bitname,src,3600;
62  hostbits:set,bitname,dst,60;
63  hostbits:set,bitname,both,120;
64  */
65 
66 #define PARSE_REGEX \
67  "^([a-z]+)" /* Action */ \
68  "(?:\\s*,\\s*([^\\s,]+))?(?:\\s*)?" /* Name. */ \
69  "(?:\\s*,\\s*([^,\\s]+))?(?:\\s*)?" /* Direction. */ \
70  "(.+)?" /* Any remaining data. */
71 static DetectParseRegex parse_regex;
72 
73 static int DetectHostbitMatch (DetectEngineThreadCtx *, Packet *,
74  const Signature *, const SigMatchCtx *);
75 static int DetectHostbitSetup (DetectEngineCtx *, Signature *, const char *);
76 void DetectHostbitFree (DetectEngineCtx *, void *);
77 #ifdef UNITTESTS
78 void HostBitsRegisterTests(void);
79 #endif
80 
82 {
83  sigmatch_table[DETECT_HOSTBITS].name = "hostbits";
84  sigmatch_table[DETECT_HOSTBITS].desc = "operate on host flag";
85 // sigmatch_table[DETECT_HOSTBITS].url = "/rules/flow-keywords.html#flowbits";
86  sigmatch_table[DETECT_HOSTBITS].Match = DetectHostbitMatch;
87  sigmatch_table[DETECT_HOSTBITS].Setup = DetectHostbitSetup;
89 #ifdef UNITTESTS
91 #endif
92  /* this is compatible to ip-only signatures */
94 
95  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
96 }
97 
98 static int DetectHostbitMatchToggle (Packet *p, const DetectXbitsData *fd)
99 {
100  switch (fd->tracker) {
102  if (p->host_src == NULL) {
103  p->host_src = HostGetHostFromHash(&p->src);
104  if (p->host_src == NULL)
105  return 0;
106  }
107  else
108  HostLock(p->host_src);
109 
110  HostBitToggle(p->host_src, fd->idx, SCTIME_ADD_SECS(p->ts, fd->expire));
111  HostUnlock(p->host_src);
112  break;
114  if (p->host_dst == NULL) {
115  p->host_dst = HostGetHostFromHash(&p->dst);
116  if (p->host_dst == NULL)
117  return 0;
118  }
119  else
120  HostLock(p->host_dst);
121 
122  HostBitToggle(p->host_dst, fd->idx, SCTIME_ADD_SECS(p->ts, fd->expire));
123  HostUnlock(p->host_dst);
124  break;
125  }
126  return 1;
127 }
128 
129 /* return true even if bit not found */
130 static int DetectHostbitMatchUnset (Packet *p, const DetectXbitsData *fd)
131 {
132  switch (fd->tracker) {
134  if (p->host_src == NULL) {
136  if (p->host_src == NULL)
137  return 1;
138  } else
139  HostLock(p->host_src);
140 
141  HostBitUnset(p->host_src,fd->idx);
142  HostUnlock(p->host_src);
143  break;
145  if (p->host_dst == NULL) {
147  if (p->host_dst == NULL)
148  return 1;
149  } else
150  HostLock(p->host_dst);
151 
152  HostBitUnset(p->host_dst,fd->idx);
153  HostUnlock(p->host_dst);
154  break;
155  }
156  return 1;
157 }
158 
159 static int DetectHostbitMatchSet (Packet *p, const DetectXbitsData *fd)
160 {
161  switch (fd->tracker) {
163  if (p->host_src == NULL) {
164  p->host_src = HostGetHostFromHash(&p->src);
165  if (p->host_src == NULL)
166  return 0;
167  } else
168  HostLock(p->host_src);
169 
170  HostBitSet(p->host_src, fd->idx, SCTIME_ADD_SECS(p->ts, fd->expire));
171  HostUnlock(p->host_src);
172  break;
174  if (p->host_dst == NULL) {
175  p->host_dst = HostGetHostFromHash(&p->dst);
176  if (p->host_dst == NULL)
177  return 0;
178  } else
179  HostLock(p->host_dst);
180 
181  HostBitSet(p->host_dst, fd->idx, SCTIME_ADD_SECS(p->ts, fd->expire));
182  HostUnlock(p->host_dst);
183  break;
184  }
185  return 1;
186 }
187 
188 static int DetectHostbitMatchIsset (Packet *p, const DetectXbitsData *fd)
189 {
190  int r = 0;
191  switch (fd->tracker) {
193  if (p->host_src == NULL) {
195  if (p->host_src == NULL)
196  return 0;
197  } else
198  HostLock(p->host_src);
199 
200  r = HostBitIsset(p->host_src, fd->idx, p->ts);
201  HostUnlock(p->host_src);
202  return r;
204  if (p->host_dst == NULL) {
206  if (p->host_dst == NULL)
207  return 0;
208  } else
209  HostLock(p->host_dst);
210 
211  r = HostBitIsset(p->host_dst, fd->idx, p->ts);
212  HostUnlock(p->host_dst);
213  return r;
214  }
215  return 0;
216 }
217 
218 static int DetectHostbitMatchIsnotset (Packet *p, const DetectXbitsData *fd)
219 {
220  int r = 0;
221  switch (fd->tracker) {
223  if (p->host_src == NULL) {
225  if (p->host_src == NULL)
226  return 1;
227  } else
228  HostLock(p->host_src);
229 
230  r = HostBitIsnotset(p->host_src, fd->idx, p->ts);
231  HostUnlock(p->host_src);
232  return r;
234  if (p->host_dst == NULL) {
236  if (p->host_dst == NULL)
237  return 1;
238  } else
239  HostLock(p->host_dst);
240 
241  r = HostBitIsnotset(p->host_dst, fd->idx, p->ts);
242  HostUnlock(p->host_dst);
243  return r;
244  }
245  return 0;
246 }
247 
249 {
250  switch (xd->cmd) {
252  return DetectHostbitMatchIsset(p,xd);
254  return DetectHostbitMatchIsnotset(p,xd);
256  return DetectHostbitMatchSet(p,xd);
258  return DetectHostbitMatchUnset(p,xd);
260  return DetectHostbitMatchToggle(p,xd);
261  default:
262  SCLogError("unknown cmd %" PRIu32 "", xd->cmd);
263  return 0;
264  }
265 
266  return 0;
267 }
268 
269 /*
270  * returns 0: no match
271  * 1: match
272  * -1: error
273  */
274 
275 static int DetectHostbitMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
276  const Signature *s, const SigMatchCtx *ctx)
277 {
278  const DetectXbitsData *xd = (const DetectXbitsData *)ctx;
279  if (xd == NULL)
280  return 0;
281 
282  return DetectXbitMatchHost(p, xd);
283 }
284 
285 static int DetectHostbitParse(const char *str, char *cmd, int cmd_len,
286  char *name, int name_len, char *dir, int dir_len)
287 {
288  int rc;
289  size_t pcre2len;
290 
291  pcre2_match_data *match = NULL;
292  int count = DetectParsePcreExec(&parse_regex, &match, str, 0, 0);
293  if (count != 2 && count != 3 && count != 4) {
294  SCLogError("\"%s\" is not a valid setting for hostbits.", str);
295  goto error;
296  }
297 
298  pcre2len = cmd_len;
299  rc = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)cmd, &pcre2len);
300  if (rc < 0) {
301  SCLogError("pcre2_substring_copy_bynumber failed");
302  goto error;
303  }
304 
305  if (count >= 3) {
306  pcre2len = name_len;
307  rc = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)name, &pcre2len);
308  if (rc < 0) {
309  SCLogError("pcre2_substring_copy_bynumber failed");
310  goto error;
311  }
312  if (count >= 4) {
313  pcre2len = dir_len;
314  rc = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)dir, &pcre2len);
315  if (rc < 0) {
316  SCLogError("pcre2_substring_copy_bynumber failed");
317  goto error;
318  }
319  }
320  }
321 
322  pcre2_match_data_free(match);
323  return 1;
324 
325 error:
326  if (match) {
327  pcre2_match_data_free(match);
328  }
329  return 0;
330 }
331 
332 int DetectHostbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
333 {
334  DetectXbitsData *cd = NULL;
335  uint8_t fb_cmd = 0;
336  uint8_t hb_dir = 0;
337  char fb_cmd_str[16] = "", fb_name[256] = "";
338  char hb_dir_str[16] = "";
339 
340  if (!DetectHostbitParse(rawstr, fb_cmd_str, sizeof(fb_cmd_str),
341  fb_name, sizeof(fb_name), hb_dir_str, sizeof(hb_dir_str))) {
342  return -1;
343  }
344 
345  if (strlen(hb_dir_str) > 0) {
346  if (strcmp(hb_dir_str, "src") == 0)
347  hb_dir = DETECT_XBITS_TRACK_IPSRC;
348  else if (strcmp(hb_dir_str, "dst") == 0)
349  hb_dir = DETECT_XBITS_TRACK_IPDST;
350  else if (strcmp(hb_dir_str, "both") == 0) {
351  //hb_dir = DETECT_XBITS_TRACK_IPBOTH;
352  SCLogError("'both' not implemented");
353  goto error;
354  } else {
355  // TODO
356  goto error;
357  }
358  }
359 
360  if (strcmp(fb_cmd_str,"noalert") == 0) {
361  fb_cmd = DETECT_XBITS_CMD_NOALERT;
362  } else if (strcmp(fb_cmd_str,"isset") == 0) {
363  fb_cmd = DETECT_XBITS_CMD_ISSET;
364  } else if (strcmp(fb_cmd_str,"isnotset") == 0) {
365  fb_cmd = DETECT_XBITS_CMD_ISNOTSET;
366  } else if (strcmp(fb_cmd_str,"set") == 0) {
367  fb_cmd = DETECT_XBITS_CMD_SET;
368  } else if (strcmp(fb_cmd_str,"unset") == 0) {
369  fb_cmd = DETECT_XBITS_CMD_UNSET;
370  } else if (strcmp(fb_cmd_str,"toggle") == 0) {
371  fb_cmd = DETECT_XBITS_CMD_TOGGLE;
372  } else {
373  SCLogError("ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
374  goto error;
375  }
376 
377  switch (fb_cmd) {
379  if (strlen(fb_name) != 0)
380  goto error;
381  s->action &= ~ACTION_ALERT;
382  return 0;
388  default:
389  if (strlen(fb_name) == 0)
390  goto error;
391  break;
392  }
393 
394  cd = SCMalloc(sizeof(DetectXbitsData));
395  if (unlikely(cd == NULL))
396  goto error;
397 
399  cd->cmd = fb_cmd;
400  cd->tracker = hb_dir;
401  cd->type = VAR_TYPE_HOST_BIT;
402  cd->expire = 300;
403 
404  SCLogDebug("idx %" PRIu32 ", cmd %s, name %s",
405  cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)");
406 
407  /* Okay so far so good, lets get this into a SigMatch
408  * and put it in the Signature. */
409 
410  switch (fb_cmd) {
411  /* case DETECT_XBITS_CMD_NOALERT can't happen here */
412 
415  /* checks, so packet list */
417  DETECT_SM_LIST_MATCH) == NULL) {
418  goto error;
419  }
420  break;
421 
425  /* modifiers, only run when entire sig has matched */
427  DETECT_SM_LIST_POSTMATCH) == NULL) {
428  goto error;
429  }
430  break;
431 
432  // suppress coverity warning as scan-build-7 warns w/o this.
433  // coverity[deadcode : FALSE]
434  default:
435  goto error;
436  }
437 
438  return 0;
439 
440 error:
441  if (cd != NULL)
442  SCFree(cd);
443  return -1;
444 }
445 
447 {
448  DetectXbitsData *fd = (DetectXbitsData *)ptr;
449 
450  if (fd == NULL)
451  return;
453 
454  SCFree(fd);
455 }
456 
457 #ifdef UNITTESTS
458 
459 static void HostBitsTestSetup(void)
460 {
461  StorageCleanup();
462  StorageInit();
463  HostBitInitCtx();
464  StorageFinalize();
465  HostInitConfig(true);
466 }
467 
468 static void HostBitsTestShutdown(void)
469 {
470  HostShutdown();
471  StorageCleanup();
472 }
473 
474 static int HostBitsTestParse01(void)
475 {
476  char cmd[16] = "", name[256] = "", dir[16] = "";
477 
478  /* No direction. */
479  FAIL_IF(!DetectHostbitParse("isset,name", cmd, sizeof(cmd), name,
480  sizeof(name), dir, sizeof(dir)));
481  FAIL_IF(strcmp(cmd, "isset") != 0);
482  FAIL_IF(strcmp(name, "name") != 0);
483  FAIL_IF(strlen(dir));
484 
485  /* No direction, leading space. */
486  *cmd = '\0';
487  *name = '\0';
488  *dir = '\0';
489  FAIL_IF(!DetectHostbitParse("isset, name", cmd, sizeof(cmd), name,
490  sizeof(name), dir, sizeof(dir)));
491  FAIL_IF(strcmp(cmd, "isset") != 0);
492  FAIL_IF(strcmp(name, "name") != 0);
493 
494  /* No direction, trailing space. */
495  *cmd = '\0';
496  *name = '\0';
497  *dir = '\0';
498  FAIL_IF(!DetectHostbitParse("isset,name ", cmd, sizeof(cmd), name,
499  sizeof(name), dir, sizeof(dir)));
500  FAIL_IF(strcmp(cmd, "isset") != 0);
501  FAIL_IF(strcmp(name, "name") != 0);
502 
503  /* No direction, leading and trailing space. */
504  *cmd = '\0';
505  *name = '\0';
506  *dir = '\0';
507  FAIL_IF(!DetectHostbitParse("isset, name ", cmd, sizeof(cmd), name,
508  sizeof(name), dir, sizeof(dir)));
509  FAIL_IF(strcmp(cmd, "isset") != 0);
510  FAIL_IF(strcmp(name, "name") != 0);
511 
512  /* With direction. */
513  *cmd = '\0';
514  *name = '\0';
515  *dir = '\0';
516  FAIL_IF(!DetectHostbitParse("isset,name,src", cmd, sizeof(cmd), name,
517  sizeof(name), dir, sizeof(dir)));
518  FAIL_IF(strcmp(cmd, "isset") != 0);
519  FAIL_IF(strcmp(name, "name") != 0);
520  FAIL_IF(strcmp(dir, "src") != 0);
521 
522  /* With direction - leading and trailing spaces on name. */
523  *cmd = '\0';
524  *name = '\0';
525  *dir = '\0';
526  FAIL_IF(!DetectHostbitParse("isset, name ,src", cmd, sizeof(cmd), name,
527  sizeof(name), dir, sizeof(dir)));
528  FAIL_IF(strcmp(cmd, "isset") != 0);
529  FAIL_IF(strcmp(name, "name") != 0);
530  FAIL_IF(strcmp(dir, "src") != 0);
531 
532  /* With direction - space around direction. */
533  *cmd = '\0';
534  *name = '\0';
535  *dir = '\0';
536  FAIL_IF(!DetectHostbitParse("isset, name , src ", cmd, sizeof(cmd), name,
537  sizeof(name), dir, sizeof(dir)));
538  FAIL_IF(strcmp(cmd, "isset") != 0);
539  FAIL_IF(strcmp(name, "name") != 0);
540  FAIL_IF(strcmp(dir, "src") != 0);
541 
542  /* Name with space, no direction - should fail. */
543  *cmd = '\0';
544  *name = '\0';
545  *dir = '\0';
546  FAIL_IF(DetectHostbitParse("isset, name withspace ", cmd, sizeof(cmd), name,
547  sizeof(name), dir, sizeof(dir)));
548 
549  PASS;
550 }
551 
552 /**
553  * \test HostBitsTestSig01 is a test for a valid noalert flowbits option
554  *
555  * \retval 1 on success
556  * \retval 0 on failure
557  */
558 
559 static int HostBitsTestSig01(void)
560 {
561  uint8_t *buf = (uint8_t *)
562  "GET /one/ HTTP/1.1\r\n"
563  "Host: one.example.org\r\n"
564  "\r\n";
565  uint16_t buflen = strlen((char *)buf);
566  Packet *p = PacketGetFromAlloc();
567  FAIL_IF_NULL(p);
568  Signature *s = NULL;
569  ThreadVars th_v;
570  DetectEngineThreadCtx *det_ctx = NULL;
571  DetectEngineCtx *de_ctx = NULL;
572 
573  memset(&th_v, 0, sizeof(th_v));
574  p->src.family = AF_INET;
575  p->dst.family = AF_INET;
576  p->payload = buf;
577  p->payload_len = buflen;
578  p->proto = IPPROTO_TCP;
579 
580  HostBitsTestSetup();
581 
584 
585  de_ctx->flags |= DE_QUIET;
586 
587  s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (hostbits:set,abc; content:\"GET \"; sid:1;)");
588  FAIL_IF_NULL(s);
589 
591  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
592 
593  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
594 
595  PacketFree(p);
596  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
598  HostBitsTestShutdown();
599  StatsThreadCleanup(&th_v);
600  PASS;
601 }
602 
603 /**
604  * \test various options
605  *
606  * \retval 1 on success
607  * \retval 0 on failure
608  */
609 
610 static int HostBitsTestSig02(void)
611 {
612  Signature *s = NULL;
613  ThreadVars th_v;
614  DetectEngineCtx *de_ctx = NULL;
615 
616  memset(&th_v, 0, sizeof(th_v));
617 
620 
621  de_ctx->flags |= DE_QUIET;
622 
624  "alert ip any any -> any any (hostbits:isset,abc,src; content:\"GET \"; sid:1;)");
625  FAIL_IF_NULL(s);
626 
628  "alert ip any any -> any any (hostbits:isnotset,abc,dst; content:\"GET \"; sid:2;)");
629  FAIL_IF_NULL(s);
630 
632  "alert ip any any -> any any (hostbits:!isset,abc,dst; content:\"GET \"; sid:3;)");
633  FAIL_IF_NOT_NULL(s);
634 
635 /* TODO reenable after both is supported
636  s = DetectEngineAppendSig(de_ctx,
637  "alert ip any any -> any any (hostbits:set,abc,both; content:\"GET \"; sid:3;)");
638  FAIL_IF_NULL(s);
639 */
641  "alert ip any any -> any any (hostbits:unset,abc,src; content:\"GET \"; sid:4;)");
642  FAIL_IF_NULL(s);
643 
645  "alert ip any any -> any any (hostbits:toggle,abc,dst; content:\"GET \"; sid:5;)");
646  FAIL_IF_NULL(s);
647 
649  PASS;
650 }
651 
652 /**
653  * \test HostBitsTestSig03 is a test check idx value
654  *
655  * \retval 1 on success
656  * \retval 0 on failure
657  */
658 
659 static int HostBitsTestSig03(void)
660 {
661  uint8_t *buf = (uint8_t *)
662  "GET /one/ HTTP/1.1\r\n"
663  "Host: one.example.org\r\n"
664  "\r\n";
665  uint16_t buflen = strlen((char *)buf);
666  Packet *p = PacketGetFromAlloc();
667  if (unlikely(p == NULL))
668  return 0;
669  Signature *s = NULL;
670  ThreadVars th_v;
671  DetectEngineThreadCtx *det_ctx = NULL;
672  DetectEngineCtx *de_ctx = NULL;
673  int idx = 0;
674 
675  memset(&th_v, 0, sizeof(th_v));
676  p->src.family = AF_INET;
677  p->dst.family = AF_INET;
678  p->payload = buf;
679  p->payload_len = buflen;
680  p->proto = IPPROTO_TCP;
681 
682  HostBitsTestSetup();
683 
686 
687  de_ctx->flags |= DE_QUIET;
688 
689  s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; hostbits:isset,fbt; content:\"GET \"; sid:1;)");
690  FAIL_IF_NULL(s);
691 
693  FAIL_IF(idx == 0);
694 
696  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
697 
698  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
699 
700  PacketFree(p);
701  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
703  HostBitsTestShutdown();
704  StatsThreadCleanup(&th_v);
705  PASS;
706 }
707 
708 /**
709  * \brief this function registers unit tests for HostBits
710  */
712 {
713  UtRegisterTest("HostBitsTestParse01", HostBitsTestParse01);
714  UtRegisterTest("HostBitsTestSig01", HostBitsTestSig01);
715  UtRegisterTest("HostBitsTestSig02", HostBitsTestSig02);
716  UtRegisterTest("HostBitsTestSig03", HostBitsTestSig03);
717 }
718 #endif /* UNITTESTS */
HostUnlock
void HostUnlock(Host *h)
Definition: host.c:472
Packet_::proto
uint8_t proto
Definition: decode.h:523
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1459
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
DetectXbitsData_::expire
uint32_t expire
Definition: detect-xbits.h:45
StorageInit
void StorageInit(void)
Definition: util-storage.c:70
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1444
flow-util.h
DetectParseRegex
Definition: detect-parse.h:93
SigTableElmt_::name
const char * name
Definition: detect.h:1457
HostBitsRegisterTests
void HostBitsRegisterTests(void)
this function registers unit tests for HostBits
Definition: detect-hostbits.c:711
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:622
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SigTableElmt_::flags
uint32_t flags
Definition: detect.h:1448
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
Packet_::payload
uint8_t * payload
Definition: decode.h:605
action-globals.h
PARSE_REGEX
#define PARSE_REGEX
Definition: detect-hostbits.c:66
threads.h
ctx
struct Thresholds ctx
HostBitSet
void HostBitSet(Host *h, uint32_t idx, SCTime_t expire)
Definition: host-bit.c:131
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectXbitsData_::cmd
uint8_t cmd
Definition: detect-xbits.h:43
HostGetHostFromHash
Host * HostGetHostFromHash(Address *a)
Definition: host.c:486
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2633
StorageCleanup
void StorageCleanup(void)
Definition: util-storage.c:78
flow-bit.h
util-var-name.h
DETECT_XBITS_TRACK_IPDST
#define DETECT_XBITS_TRACK_IPDST
Definition: detect-xbits.h:35
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
DetectHostbitsRegister
void DetectHostbitsRegister(void)
Definition: detect-hostbits.c:81
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2416
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, pcre2_match_data **match, const char *str, int start_offset, int options)
Definition: detect-parse.c:3493
VarNameStoreRegister
uint32_t VarNameStoreRegister(const char *name, const enum VarTypes type)
Definition: util-var-name.c:155
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:623
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1439
HostBitInitCtx
void HostBitInitCtx(void)
Definition: host-bit.c:49
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:606
DetectXbitsData_
Definition: detect-xbits.h:41
util-unittest.h
DETECT_HOSTBITS
@ DETECT_HOSTBITS
Definition: detect-engine-register.h:63
DETECT_SM_LIST_POSTMATCH
@ DETECT_SM_LIST_POSTMATCH
Definition: detect.h:127
DetectXbitMatchHost
int DetectXbitMatchHost(Packet *p, const DetectXbitsData *xd)
Definition: detect-hostbits.c:248
DETECT_XBITS_CMD_ISNOTSET
#define DETECT_XBITS_CMD_ISNOTSET
Definition: detect-xbits.h:30
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1244
Packet_::ts
SCTime_t ts
Definition: decode.h:555
HostBitUnset
void HostBitUnset(Host *h, uint32_t idx)
Definition: host-bit.c:139
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:3619
detect-engine-mpm.h
SCSigMatchAppendSMToList
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:388
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3360
VarNameStoreUnregister
void VarNameStoreUnregister(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:201
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:219
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
SigInit
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:3097
app-layer-parser.h
HostLock
void HostLock(Host *h)
Definition: host.c:467
Signature_::action
uint8_t action
Definition: detect.h:683
DetectXbitsData_::type
enum VarTypes type
Definition: detect-xbits.h:47
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
Packet_
Definition: decode.h:501
detect-engine-build.h
StorageFinalize
int StorageFinalize(void)
Definition: util-storage.c:140
name
const char * name
Definition: tm-threads.c:2163
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1419
HostBitIsset
int HostBitIsset(Host *h, uint32_t idx, SCTime_t ts)
Definition: host-bit.c:157
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
HostBitToggle
void HostBitToggle(Host *h, uint32_t idx, SCTime_t expire)
Definition: host-bit.c:147
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3592
util-spm.h
DetectXbitsData_::idx
uint32_t idx
Definition: detect-xbits.h:42
HostBitIsnotset
int HostBitIsnotset(Host *h, uint32_t idx, SCTime_t ts)
Definition: host-bit.c:170
HostShutdown
void HostShutdown(void)
shutdown the flow engine
Definition: host.c:296
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:941
detect-hostbits.h
VAR_TYPE_HOST_BIT
@ VAR_TYPE_HOST_BIT
Definition: util-var.h:41
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
detect-engine-sigorder.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
DetectXbitsData_::tracker
uint8_t tracker
Definition: detect-xbits.h:44
str
#define str(s)
Definition: suricata-common.h:308
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:271
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DETECT_XBITS_TRACK_IPSRC
#define DETECT_XBITS_TRACK_IPSRC
Definition: detect-xbits.h:34
detect-parse.h
Signature_
Signature container.
Definition: detect.h:668
DETECT_XBITS_CMD_NOALERT
#define DETECT_XBITS_CMD_NOALERT
Definition: detect-xbits.h:32
DETECT_XBITS_CMD_ISSET
#define DETECT_XBITS_CMD_ISSET
Definition: detect-xbits.h:31
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2594
HostLookupHostFromHash
Host * HostLookupHostFromHash(Address *a)
look up a host in the hash
Definition: host.c:585
Address_::family
char family
Definition: decode.h:113
Packet_::dst
Address dst
Definition: decode.h:506
HostInitConfig
void HostInitConfig(bool quiet)
initialize the configuration
Definition: host.c:168
DETECT_XBITS_CMD_SET
#define DETECT_XBITS_CMD_SET
Definition: detect-xbits.h:27
DetectHostbitFree
void DetectHostbitFree(DetectEngineCtx *, void *)
Definition: detect-hostbits.c:446
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
DETECT_XBITS_CMD_TOGGLE
#define DETECT_XBITS_CMD_TOGGLE
Definition: detect-xbits.h:28
flow.h
DETECT_XBITS_CMD_UNSET
#define DETECT_XBITS_CMD_UNSET
Definition: detect-xbits.h:29
SCTIME_ADD_SECS
#define SCTIME_ADD_SECS(ts, s)
Definition: util-time.h:64
StatsThreadCleanup
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1324
SIGMATCH_IPONLY_COMPAT
#define SIGMATCH_IPONLY_COMPAT
Definition: detect.h:1651
Packet_::src
Address src
Definition: decode.h:505
host-bit.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1446