detect.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "conf.h"
#include "decode.h"
#include "flow.h"
#include "stream-tcp.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-profile.h"
#include "detect-engine-alert.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-proto.h"
#include "detect-engine-port.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-threshold.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-state.h"
#include "detect-engine-analyzer.h"
#include "detect-engine-payload.h"
#include "detect-engine-event.h"
#include "detect-filestore.h"
#include "detect-flowvar.h"
#include "detect-replace.h"
#include "util-validate.h"
#include "util-detect.h"
#include "tests/detect.c"
Include dependency graph for detect.c:

Go to the source code of this file.

Data Structures

struct  DetectRunScratchpad


#define TRACE_SID_TXS(sid, txs, ...)


typedef struct DetectRunScratchpad DetectRunScratchpad


const SigGroupHeadSigMatchSignaturesGetSgh (const DetectEngineCtx *de_ctx, const Packet *p)
 Get the SigGroupHead for a packet. More...
void RuleMatchCandidateTxArrayInit (DetectEngineThreadCtx *det_ctx, uint32_t size)
void RuleMatchCandidateTxArrayFree (DetectEngineThreadCtx *det_ctx)
void DetectSignatureApplyActions (Packet *p, const Signature *s, const uint8_t alert_flags)
 Apply action(s) and Set 'drop' sig info, if applicable. More...
TmEcode Detect (ThreadVars *tv, Packet *p, void *data)
 Detection engine thread wrapper. More...
void DisableDetectFlowFileFlags (Flow *f)
 disable file features we don't need Called if we have no detection engine. More...
void SigMatchSignatures (ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
 wrapper for old tests More...

Detailed Description

Victor Julien

Basic detection engine

Definition in file detect.c.

Macro Definition Documentation


#define TRACE_SID_TXS (   sid,

Definition at line 1033 of file detect.c.

Typedef Documentation

◆ DetectRunScratchpad

Function Documentation

◆ Detect()

TmEcode Detect ( ThreadVars tv,
Packet p,
void *  data 

Detection engine thread wrapper.

tvthread vars
ppacket to inspect
datathread specific data
pqpacket queue
Return values

Definition at line 1620 of file detect.c.

References de_ctx, DEBUG_VALIDATE_PACKET, DetectEngineThreadCtx_::mt_det_ctxs_cnt, SC_ATOMIC_GET, SC_ATOMIC_SET, SCLogDebug, Packet_::tenant_id, DetectEngineThreadCtx_::TenantGetId, and unlikely.

◆ DetectSignatureApplyActions()

void DetectSignatureApplyActions ( Packet p,
const Signature s,
const uint8_t  alert_flags 

◆ DisableDetectFlowFileFlags()

void DisableDetectFlowFileFlags ( Flow f)

disable file features we don't need Called if we have no detection engine.

Definition at line 1678 of file detect.c.

◆ RuleMatchCandidateTxArrayFree()

void RuleMatchCandidateTxArrayFree ( DetectEngineThreadCtx det_ctx)

◆ RuleMatchCandidateTxArrayInit()

void RuleMatchCandidateTxArrayInit ( DetectEngineThreadCtx det_ctx,
uint32_t  size 

◆ SigMatchSignatures()

void SigMatchSignatures ( ThreadVars th_v,
DetectEngineCtx de_ctx,
DetectEngineThreadCtx det_ctx,
Packet p 

wrapper for old tests

Definition at line 1688 of file detect.c.

Referenced by UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the caller graph for this function:

◆ SigMatchSignaturesGetSgh()

const SigGroupHead* SigMatchSignaturesGetSgh ( const DetectEngineCtx de_ctx,
const Packet p 

Get the SigGroupHead for a packet.

de_ctxdetection engine context
Return values
sghthe SigGroupHead or NULL if non applies to the packet

Definition at line 177 of file detect.c.

References PacketEngineEvents_::cnt, de_ctx, DetectEngineCtx_::decoder_event_sgh, Packet_::events, FLOW_PKT_TOCLIENT, Packet_::flowflags, IP_GET_IPPROTO, PKT_IS_IPV4, PKT_IS_IPV6, proto, Packet_::proto, SCEnter, and SCReturnPtr.