suricata
|
Files | |
file | detect-engine-state.c |
State based signature handling. | |
file | detect-engine-state.h |
Data structures and function prototypes for keeping state for the detection engine. | |
Macros | |
#define | CASE_CODE(E) case E: return #E |
Functions | |
DetectEngineState * | DetectEngineStateAlloc (void) |
Alloc a DetectEngineState object. More... | |
void | DetectEngineStateFree (DetectEngineState *state) |
Frees a DetectEngineState object. More... | |
void | DetectRunStoreStateTx (const SigGroupHead *sgh, Flow *f, void *tx, uint64_t tx_id, const Signature *s, uint32_t inspect_flags, uint8_t flow_flags, const uint16_t file_no_match) |
void | DeStateUpdateInspectTransactionId (Flow *f, const uint8_t flags, const bool tag_txs_as_inspected) |
update flow's inspection id's More... | |
void | DetectEngineStateResetTxs (Flow *f) |
Reset de state for active tx' To be used on detect engine reload. More... | |
void | DeStateRegisterTests (void) |
State is stored in the DetectEngineState structure. This is basically a containter for storage item of type DeStateStore. They contains an array of DeStateStoreItem which store the state of match for an individual signature identified by DeStateStoreItem::sid.
#define CASE_CODE | ( | E | ) | case E: return #E |
convert enum to string
Definition at line 70 of file detect-engine-state.c.
void DeStateRegisterTests | ( | void | ) |
Definition at line 1370 of file detect-engine-state.c.
References UtRegisterTest().
void DeStateUpdateInspectTransactionId | ( | Flow * | f, |
const uint8_t | flags, | ||
const bool | tag_txs_as_inspected | ||
) |
update flow's inspection id's
Update the inspect id.
f | unlocked flow |
flags | direction and disruption flags |
tag_txs_as_inspected | if true all 'complete' txs will be marked 'inspected' |
Definition at line 253 of file detect-engine-state.c.
References Flow_::alparser, Flow_::alstate, and AppLayerParserSetTransactionInspectId().
Referenced by DetectSignatureApplyActions(), and SigMatchSignaturesGetSgh().
DetectEngineState* DetectEngineStateAlloc | ( | void | ) |
Alloc a DetectEngineState object.
Alloc'd | instance of DetectEngineState. |
Definition at line 166 of file detect-engine-state.c.
References SCMalloc, and unlikely.
Referenced by DetectEngineStateResetTxs(), and DetectRunStoreStateTx().
void DetectEngineStateFree | ( | DetectEngineState * | state | ) |
Frees a DetectEngineState object.
state | DetectEngineState instance to free. |
Definition at line 176 of file detect-engine-state.c.
References DetectEngineState_::dir_state, FileDisableStoringForTransaction(), DetectEngineStateDirection_::filestore_cnt, SigGroupHead_::filestore_cnt, DetectEngineStateDirection_::head, DeStateStore_::next, SCFree, SCLogDebug, STREAM_TOCLIENT, STREAM_TOSERVER, and tx_id.
Referenced by DCERPCCleanup(), DetectEngineStateResetTxs(), DetectRunStoreStateTx(), FTPMemcapGlobalCounter(), main(), SMTPStateAlloc(), and SSLVersionToString().
void DetectEngineStateResetTxs | ( | Flow * | f | ) |
Reset de state for active tx' To be used on detect engine reload.
f | write LOCKED flow |
Definition at line 268 of file detect-engine-state.c.
References Flow_::alparser, Flow_::alproto, ALPROTO_HTTP, Flow_::alstate, AppLayerParserGetFiles(), AppLayerParserGetTransactionInspectId(), AppLayerParserGetTx(), AppLayerParserGetTxCnt(), AppLayerParserGetTxDetectState(), AppLayerParserParse(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), BIT_U32, DetectEngineStateDirection_::cnt, DE_QUIET, DE_STATE_FLAG_BASE, DetectEngineAppendSig(), DetectEngineCtxFree(), DetectEngineCtxInit(), DetectEngineStateAlloc(), DetectEngineStateFree(), DetectEngineThreadCtxDeinit(), DetectEngineThreadCtxInit(), DetectEngineState_::dir_state, FAIL_IF, FAIL_IF_NOT, FAIL_IF_NULL, FILE_NOSTORE, FILE_STORE, HtpState_::files_ts, DetectEngineStateDirection_::filestore_cnt, File_::flags, DeStateStoreItem_::flags, DetectEngineStateDirection_::flags, Flow_::flags, Packet_::flags, DetectEngineCtx_::flags, Packet_::flow, FLOW_DESTROY, FLOW_INITIALIZE, FLOW_IPV4, FLOW_PKT_ESTABLISHED, FLOW_PKT_TOSERVER, Packet_::flowflags, FlowGetAppState(), DetectEngineStateDirection_::head, FileContainer_::head, MIN, File_::next, DeStateStore_::next, Signature_::num, PacketAlertCheck(), PASS, PKT_HAS_FLOW, PKT_STREAM_EST, Flow_::proto, Flow_::protoctx, SCLogDebug, DeStateStoreItem_::sid, DetectEngineCtx_::sig_list, SigGroupBuild(), SigInit(), SigMatchSignatures(), DeStateStore_::store, STREAM_EOF, STREAM_START, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TRUE, UTHBuildFlow(), UTHBuildPacket(), UTHFreeFlow(), and UTHFreePacket().
Referenced by SigMatchSignaturesGetSgh().
void DetectRunStoreStateTx | ( | const SigGroupHead * | sgh, |
Flow * | f, | ||
void * | tx, | ||
uint64_t | tx_id, | ||
const Signature * | s, | ||
uint32_t | inspect_flags, | ||
uint8_t | flow_flags, | ||
const uint16_t | file_no_match | ||
) |
Definition at line 221 of file detect-engine-state.c.
References Flow_::alproto, AppLayerParserGetTxDetectState(), AppLayerParserSetTxDetectState(), DetectEngineStateAlloc(), DetectEngineStateFree(), Flow_::proto, and SCLogDebug.