suricata
util-classification-config.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine.h"
#include "util-hash.h"
#include "conf.h"
#include "util-classification-config.h"
#include "util-unittest.h"
#include "util-error.h"
#include "util-debug.h"
#include "util-fmemopen.h"
Include dependency graph for util-classification-config.c:

Go to the source code of this file.

Macros

#define DETECT_CLASSCONFIG_REGEX   "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"
 
#define SC_CLASS_CONF_DEF_CONF_FILEPATH   CONFIG_DIR "/classification.config"
 
#define MAX_SUBSTRINGS   30
 

Functions

uint32_t SCClassConfClasstypeHashFunc (HashTable *ht, void *data, uint16_t datalen)
 Hashing function to be used to hash the Classtype name. Would be supplied as an argument to the HashTableInit function for DetectEngineCtx->class_conf_ht. More...
 
char SCClassConfClasstypeHashCompareFunc (void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
 Used to compare two Classtypes that have been stored in the HashTable. This function is supplied as an argument to the HashTableInit function for DetectionEngineCtx->class_conf_ct. More...
 
void SCClassConfClasstypeHashFree (void *ch)
 Used to free the Classification Config Hash Data that was stored in DetectEngineCtx->class_conf_ht Hashtable. More...
 
void SCClassConfInit (void)
 
void SCClassConfDeinit (void)
 
void SCClassConfDeInitContext (DetectEngineCtx *de_ctx)
 Releases resources used by the Classification Config API. More...
 
SCClassConfClasstypeSCClassConfAllocClasstype (uint8_t classtype_id, const char *classtype, const char *classtype_desc, int priority)
 Returns a new SCClassConfClasstype instance. The classtype string is converted into lowercase, before being assigned to the instance. More...
 
void SCClassConfDeAllocClasstype (SCClassConfClasstype *ct)
 Frees a SCClassConfClasstype instance. More...
 
void SCClassConfLoadClassficationConfigFile (DetectEngineCtx *de_ctx, FILE *fd)
 Loads the Classtype info from the classification.config file. More...
 
SCClassConfClasstypeSCClassConfGetClasstype (const char *ct_name, DetectEngineCtx *de_ctx)
 Gets the classtype from the corresponding hash table stored in the Detection Engine Context's class conf ht, given the classtype name. More...
 
FILE * SCClassConfGenerateValidDummyClassConfigFD01 (void)
 Creates a dummy classification file, with all valid Classtypes, for testing purposes. More...
 
FILE * SCClassConfGenerateInValidDummyClassConfigFD02 (void)
 Creates a dummy classification file, with some valid Classtypes and a couple of invalid Classtypes, for testing purposes. More...
 
FILE * SCClassConfGenerateInValidDummyClassConfigFD03 (void)
 Creates a dummy classification file, with all invalid Classtypes, for testing purposes. More...
 
void SCClassConfRegisterTests (void)
 This function registers unit tests for Classification Config API. More...
 

Detailed Description

Author
Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Used for parsing a classification.config file

Definition in file util-classification-config.c.

Macro Definition Documentation

#define DETECT_CLASSCONFIG_REGEX   "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"

Definition at line 41 of file util-classification-config.c.

Referenced by SCClassConfInit().

#define MAX_SUBSTRINGS   30
#define SC_CLASS_CONF_DEF_CONF_FILEPATH   CONFIG_DIR "/classification.config"

Definition at line 47 of file util-classification-config.c.

Referenced by SCClassConfDeinit().

Function Documentation

SCClassConfClasstype* SCClassConfAllocClasstype ( uint8_t  classtype_id,
const char *  classtype,
const char *  classtype_desc,
int  priority 
)

Returns a new SCClassConfClasstype instance. The classtype string is converted into lowercase, before being assigned to the instance.

Parameters
classtypePointer to the classification type.
classtype_descPointer to the classification type description.
priorityHolds the priority for the classification type.
Return values
ctPointer to the new instance of SCClassConfClasstype on success; NULL on failure.

Definition at line 387 of file util-classification-config.c.

References SCClassConfClasstype_::classtype, SCClassConfClasstype_::classtype_desc, SCClassConfClasstype_::classtype_id, SCClassConfClasstype_::priority, SC_ERR_MEM_ALLOC, SCClassConfDeAllocClasstype(), SCLogError, SCMalloc, and SCStrdup.

Referenced by SCClassConfDeInitContext().

Here is the call graph for this function:

Here is the caller graph for this function:

char SCClassConfClasstypeHashCompareFunc ( void *  data1,
uint16_t  datalen1,
void *  data2,
uint16_t  datalen2 
)

Used to compare two Classtypes that have been stored in the HashTable. This function is supplied as an argument to the HashTableInit function for DetectionEngineCtx->class_conf_ct.

Parameters
data1Pointer to the first SCClassConfClasstype to be compared.
len1Not used by this function.
data2Pointer to the second SCClassConfClasstype to be compared.
len2Not used by this function.
Return values
1On data1 and data2 being equal.
0On data1 and data2 not being equal.

Definition at line 481 of file util-classification-config.c.

References SCClassConfClasstype_::classtype, and SCLogDebug.

Referenced by SCClassConfDeinit().

Here is the caller graph for this function:

void SCClassConfClasstypeHashFree ( void *  ch)

Used to free the Classification Config Hash Data that was stored in DetectEngineCtx->class_conf_ht Hashtable.

Parameters
chPointer to the data that has to be freed.

Definition at line 512 of file util-classification-config.c.

References SCClassConfDeAllocClasstype().

Referenced by SCClassConfDeinit().

Here is the call graph for this function:

Here is the caller graph for this function:

uint32_t SCClassConfClasstypeHashFunc ( HashTable ht,
void *  data,
uint16_t  datalen 
)

Hashing function to be used to hash the Classtype name. Would be supplied as an argument to the HashTableInit function for DetectEngineCtx->class_conf_ht.

Parameters
htPointer to the HashTable.
dataPointer to the data to be hashed. In this case, the data would be a pointer to a SCClassConfClasstype instance.
datalenNot used by this function.

Definition at line 452 of file util-classification-config.c.

References HashTable_::array_size, SCClassConfClasstype_::classtype, and len.

Referenced by SCClassConfDeinit().

Here is the caller graph for this function:

void SCClassConfDeAllocClasstype ( SCClassConfClasstype ct)

Frees a SCClassConfClasstype instance.

Parameters
Pointerto the SCClassConfClasstype instance that has to be freed

Definition at line 427 of file util-classification-config.c.

References SCClassConfClasstype_::classtype, SCClassConfClasstype_::classtype_desc, and SCFree.

Referenced by SCClassConfAllocClasstype(), and SCClassConfClasstypeHashFree().

Here is the caller graph for this function:

void SCClassConfDeInitContext ( DetectEngineCtx de_ctx)

Releases resources used by the Classification Config API.

Definition at line 202 of file util-classification-config.c.

References DetectEngineCtx_::class_conf_ht, SCClassConfClasstype_::classtype, SCClassConfClasstype_::classtype_desc, HashTable_::count, HashTableAdd(), HashTableFree(), HashTableLookup(), index, MAX_SUBSTRINGS, SC_ERR_INVALID_SIGNATURE, SC_ERR_MEM_ALLOC, SCClassConfAllocClasstype(), SCFree, SCLogDebug, SCLogError, SCLogInfo, SCStrdup, and str.

Referenced by DetectEngineCtxFree().

Here is the call graph for this function:

Here is the caller graph for this function:

FILE* SCClassConfGenerateInValidDummyClassConfigFD02 ( void  )

Creates a dummy classification file, with some valid Classtypes and a couple of invalid Classtypes, for testing purposes.

Pointer to the file_path for the dummy classification file.

Definition at line 608 of file util-classification-config.c.

References SCFmemopen, and SCLogDebug.

Referenced by SCClassConfGenerateInValidDummyClassConfigFD03().

Here is the caller graph for this function:

FILE* SCClassConfGenerateInValidDummyClassConfigFD03 ( void  )

Creates a dummy classification file, with all invalid Classtypes, for testing purposes.

Pointer to the file_path for the dummy classification file.

Definition at line 632 of file util-classification-config.c.

References DetectEngineCtx_::class_conf_ht, HashTable_::count, DetectEngineCtxFree(), DetectEngineCtxInit(), SCClassConfGenerateInValidDummyClassConfigFD02(), SCClassConfGenerateInValidDummyClassConfigFD03(), SCClassConfGenerateValidDummyClassConfigFD01(), SCClassConfGetClasstype(), SCClassConfLoadClassficationConfigFile(), SCFmemopen, and SCLogDebug.

Referenced by SCClassConfGenerateInValidDummyClassConfigFD03().

Here is the call graph for this function:

Here is the caller graph for this function:

FILE* SCClassConfGenerateValidDummyClassConfigFD01 ( void  )

Creates a dummy classification file, with all valid Classtypes, for testing purposes.

Pointer to the file_path for the dummy classification file.

Definition at line 588 of file util-classification-config.c.

References SCFmemopen, and SCLogDebug.

Referenced by AlertFastLogInitCtx(), DetectClasstypeRegister(), DetectMsgRegister(), DetectSetupParseRegexes(), and SCClassConfGenerateInValidDummyClassConfigFD03().

Here is the caller graph for this function:

SCClassConfClasstype* SCClassConfGetClasstype ( const char *  ct_name,
DetectEngineCtx de_ctx 
)

Gets the classtype from the corresponding hash table stored in the Detection Engine Context's class conf ht, given the classtype name.

Parameters
ct_namePointer to the classtype name that has to be looked up.
de_ctxPointer to the Detection Engine Context.
Return values
lookup_ct_infoPointer to the SCClassConfClasstype instance from the hash table on success; NULL on failure.

Definition at line 562 of file util-classification-config.c.

References DetectEngineCtx_::class_conf_ht, and HashTableLookup().

Referenced by DetectClasstypeRegister(), and SCClassConfGenerateInValidDummyClassConfigFD03().

Here is the call graph for this function:

Here is the caller graph for this function:

void SCClassConfInit ( void  )

Definition at line 59 of file util-classification-config.c.

References DETECT_CLASSCONFIG_REGEX, and SCLogDebug.

Referenced by DetectSetupParseRegexes(), PostRunDeinit(), and RunUnittests().

Here is the caller graph for this function:

void SCClassConfLoadClassficationConfigFile ( DetectEngineCtx de_ctx,
FILE *  fd 
)

Loads the Classtype info from the classification.config file.

The classification.config file contains the different classtypes, that can be used to label Signatures. Each line of the file should have the following format - classtype_name, classtype_description, priority None of the above parameters should hold a quote inside the file.

Parameters
de_ctxPointer to the Detection Engine Context that should be updated with Classtype information.

Definition at line 531 of file util-classification-config.c.

References RunmodeIsUnittests(), SC_ERR_OPENING_FILE, and SCLogError.

Referenced by AlertFastLogInitCtx(), DetectClasstypeRegister(), DetectEngineInspectPktBufferGeneric(), DetectMsgRegister(), DetectSetupParseRegexes(), and SCClassConfGenerateInValidDummyClassConfigFD03().

Here is the call graph for this function:

Here is the caller graph for this function:

void SCClassConfRegisterTests ( void  )

This function registers unit tests for Classification Config API.

Definition at line 825 of file util-classification-config.c.

References UtRegisterTest().

Here is the call graph for this function: