suricata
util-debug-filters.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  */
23 
24 #ifndef __DEBUG_FILTERS_H__
25 #define __DEBUG_FILTERS_H__
26 
27 #include <pthread.h>
28 #include "threads.h"
29 #include "util-mem.h"
30 
31 /**
32  * \brief Enum that holds the different kinds of filters available
33  */
34 enum {
38 };
39 
40 /**
41  * \brief Structure used to hold the line_no details of a FG filter
42  */
43 typedef struct SCLogFGFilterLine_ {
44  int line;
45 
48 
49 /**
50  * \brief structure used to hold the function details of a FG filter
51  */
52 typedef struct SCLogFGFilterFunc_ {
53  char *func;
55 
58 
59 /**
60  * \brief Structure used to hold FG filters. Encapsulates filename details,
61  * func details, which inturn encapsulates the line_no details
62  */
63 typedef struct SCLogFGFilterFile_ {
64  char *file;
66 
69 
70 /**
71  * \brief Structure used to hold the thread_list used by FD filters
72  */
73 typedef struct SCLogFDFilterThreadList_ {
74  int entered;
75  pthread_t t;
76 // pid_t t;
77 
80 
81 /**
82  * \brief Structure that holds the FD filters
83  */
84 typedef struct SCLogFDFilter_ {
85  char *func;
86 
89 
90 
91 extern int sc_log_fg_filters_present;
92 
93 extern int sc_log_fd_filters_present;
94 
95 
96 int SCLogAddFGFilterWL(const char *, const char *, int);
97 
98 int SCLogAddFGFilterBL(const char *, const char *, int);
99 
100 int SCLogMatchFGFilterBL(const char *, const char *, int);
101 
102 int SCLogMatchFGFilterWL(const char *, const char *, int);
103 
104 void SCLogReleaseFGFilters(void);
105 
106 int SCLogAddFDFilter(const char *);
107 
108 int SCLogPrintFDFilters(void);
109 
110 void SCLogReleaseFDFilters(void);
111 
112 int SCLogRemoveFDFilter(const char *);
113 
114 int SCLogCheckFDFilterEntry(const char *);
115 
116 void SCLogCheckFDFilterExit(const char *);
117 
118 int SCLogMatchFDFilter(const char *);
119 
120 int SCLogPrintFGFilters(void);
121 
123  const char *,
124  const char *, int,
125  int);
126 
129  const char *, int);
130 
133  int);
134 
136 #endif /* __DEBUG_H__ */
SCLogFGFilterLine * line
struct SCLogFGFilterLine_ SCLogFGFilterLine
Structure used to hold the line_no details of a FG filter.
int SCLogCheckFDFilterEntry(const char *)
Updates a FD filter, based on whether the function that calls this function, is registered as a FD fi...
struct SCLogFDFilter_ SCLogFDFilter
Structure that holds the FD filters.
void SCLogAddToFGFFuncList(SCLogFGFilterFile *, SCLogFGFilterFunc *, const char *, int)
Helper function used internally to add a FG filter. This function is called when the file component o...
Structure used to hold the thread_list used by FD filters.
struct SCLogFDFilterThreadList_ * next
Structure that holds the FD filters.
int sc_log_fd_filters_present
struct SCLogFGFilterLine_ * next
int SCLogAddFGFilterBL(const char *, const char *, int)
Adds a Blacklist(BL) fine-grained(FG) filter. A FG filter BL filter allows messages that don&#39;t match ...
int SCLogPrintFGFilters(void)
Prints the FG filters(both WL and BL). Used for debugging purposes.
int SCLogAddFGFilterWL(const char *, const char *, int)
Adds a Whitelist(WL) fine-grained(FG) filter. A FG filter WL filter allows messages that match this f...
int SCLogMatchFGFilterBL(const char *, const char *, int)
Checks if there is a match for the incoming log_message with any of the FG filters. If there is a match it rejects the logging for that messages, else it allows that message to be logged.
struct SCLogFGFilterFunc_ * next
struct SCLogFGFilterFile_ * next
void SCLogCheckFDFilterExit(const char *)
Updates a FD filter, based on whether the function that calls this function, is registered as a FD fi...
int SCLogAddFDFilter(const char *)
Adds a Function-Dependent(FD) filter.
struct SCLogFDFilterThreadList_ SCLogFDFilterThreadList
Structure used to hold the thread_list used by FD filters.
Structure used to hold the line_no details of a FG filter.
int SCLogPrintFDFilters(void)
Prints the FG filters(both WL and BL). Used for debugging purposes.
void SCLogReleaseFGFilters(void)
int SCLogMatchFGFilterWL(const char *, const char *, int)
Checks if there is a match for the incoming log_message with any of the FG filters. If there is a match, it allows the message to be logged, else it rejects that message.
int sc_log_fg_filters_present
void SCLogReleaseFDFilters(void)
Releases all the FD filters added to the logging module.
struct SCLogFGFilterFile_ SCLogFGFilterFile
Structure used to hold FG filters. Encapsulates filename details, func details, which inturn encapsul...
SCLogFGFilterFunc * func
structure used to hold the function details of a FG filter
void SCLogAddToFGFFileList(SCLogFGFilterFile *, const char *, const char *, int, int)
Helper function used internally to add a FG filter. This function is called when the file component o...
int SCLogRemoveFDFilter(const char *)
Removes a Function-Dependent(FD) filter.
struct SCLogFGFilterFunc_ SCLogFGFilterFunc
structure used to hold the function details of a FG filter
Structure used to hold FG filters. Encapsulates filename details, func details, which inturn encapsul...
struct SCLogFDFilter_ * next
void SCLogAddToFGFLineList(SCLogFGFilterFunc *, SCLogFGFilterLine *, int)
Helper function used internally to add a FG filter. This function is called when the file and functio...
int SCLogMatchFDFilter(const char *)
Checks if there is a match for the incoming log_message with any of the FD filters.
void SCLogReleaseFDFilter(SCLogFDFilter *)
Releases the memory alloted to a FD filter.