detect-engine-build.h File Reference

Go to the source code of this file.

Functions
void	PacketCreateMask (Packet *p, SignatureMask *mask, AppProto alproto, bool app_decoder_events)
int	SignatureIsFilestoring (const Signature *)
	Check if a signature contains the filestore keyword.
int	SignatureIsFilemagicInspecting (const Signature *)
	Check if a signature contains the filemagic keyword.
int	SignatureIsFileMd5Inspecting (const Signature *)
	Check if a signature contains the filemd5 keyword.
int	SignatureIsFileSha1Inspecting (const Signature *s)
	Check if a signature contains the filesha1 keyword.
int	SignatureIsFileSha256Inspecting (const Signature *s)
	Check if a signature contains the filesha256 keyword.
int	SignatureIsFilesizeInspecting (const Signature *)
	Check if a signature contains the filesize keyword.
void	SignatureSetType (DetectEngineCtx *de_ctx, Signature *s)
int	SigPrepareStage1 (DetectEngineCtx *de_ctx)
	Preprocess signature, classify ip-only, etc, build sig array.
int	SigPrepareStage2 (DetectEngineCtx *de_ctx)
	Fill the global src group head, with the sigs included.
int	SigPrepareStage3 (DetectEngineCtx *de_ctx)
int	SigPrepareStage4 (DetectEngineCtx *de_ctx)
	finalize preparing sgh's
int	SigAddressCleanupStage1 (DetectEngineCtx *de_ctx)
void	SigCleanSignatures (DetectEngineCtx *)
int	SigGroupBuild (DetectEngineCtx *)
	Convert the signature list into the runtime match structure.
int	SigGroupCleanup (DetectEngineCtx *de_ctx)

Function Documentation

PacketCreateMask()

void PacketCreateMask	(	Packet *	p,
		SignatureMask *	mask,
		AppProto	alproto,
		bool	app_decoder_events
	)

Definition at line 420 of file detect-engine-build.c.

References Packet_::app_layer_events, AppLayerDecoderEvents_::cnt, PacketEngineEvents_::cnt, Packet_::events, Packet_::flags, MASK_TCP_INITDEINIT_FLAGS, MASK_TCP_UNUSUAL_FLAGS, Packet_::payload_len, PKT_DETECT_HAS_STREAMDATA, PKT_HAS_FLOW, PKT_IS_PSEUDOPKT, PKT_NOPAYLOAD_INSPECTION, SCLogDebug, SIG_MASK_REQUIRE_ENGINE_EVENT, SIG_MASK_REQUIRE_FLAGS_INITDEINIT, SIG_MASK_REQUIRE_FLAGS_UNUSUAL, SIG_MASK_REQUIRE_FLOW, SIG_MASK_REQUIRE_NO_PAYLOAD, SIG_MASK_REQUIRE_PAYLOAD, SIG_MASK_REQUIRE_REAL_PKT, and TCPHdr_::th_flags.

SigAddressCleanupStage1()

int SigAddressCleanupStage1

(

DetectEngineCtx *

de_ctx

)

Definition at line 1977 of file detect-engine-build.c.

References BUG_ON, de_ctx, DetectEngineCtx_::decoder_event_sgh, DetectPortCleanupList(), DetectEngineCtx_::flow_gh, FLOW_STATES, DetectEngineCtx_::io_ctx, IPOnlyDeinit(), DetectEngineCtx_::pre_flow_sgh, DetectEngineCtx_::pre_stream_sgh, SCFree, SCLogDebug, DetectEngineLookupFlow_::sgh, DetectEngineCtx_::sgh_array, DetectEngineCtx_::sgh_array_cnt, DetectEngineCtx_::sgh_array_size, SigGroupHeadFree(), DetectEngineLookupFlow_::tcp, and DetectEngineLookupFlow_::udp.

Referenced by SigGroupCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

SigCleanSignatures()

void SigCleanSignatures

(

DetectEngineCtx *

de_ctx

)

Definition at line 56 of file detect-engine-build.c.

References de_ctx, DetectEngineResetMaxSigId(), Signature_::next, DetectEngineCtx_::sig_list, and SigFree().

Referenced by DetectEngineCtxFree(), and UTHPacketMatchSig().

Here is the call graph for this function:

Here is the caller graph for this function:

SigGroupBuild()

int SigGroupBuild

(

DetectEngineCtx *

de_ctx

)

Convert the signature list into the runtime match structure.

Parameters

de_ctx

Pointer to the Detection Engine Context whose Signatures have to be processed

Return values

0	On Success.
-1	On failure.

Definition at line 2204 of file detect-engine-build.c.

References de_ctx, DetectEngineMultiTenantEnabled(), DetectMpmPrepareAppMpms(), DetectMpmPrepareBuiltinMpms(), DetectMpmPrepareFrameMpms(), DetectMpmPreparePktMpms(), DetectSetFastPatternAndItsId(), EngineModeIsFirewall(), FatalError, FirewallAnalyzer(), Signature_::iid, Signature_::next, DetectEngineCtx_::profile_match_logging_threshold, SCConfGetInt(), SCProfilingKeywordInitCounters(), SCProfilingPrefilterInitCounters(), DetectEngineCtx_::sig_list, DetectEngineCtx_::signum, SigPrepareStage1(), SigPrepareStage2(), SigPrepareStage3(), SigPrepareStage4(), and VarNameStoreActivate().

Referenced by SigLoadSignatures(), UTHMatchPackets(), UTHMatchPacketsWithResults(), UTHPacketMatchSig(), and UTHPacketMatchSigMpm().

Here is the call graph for this function:

Here is the caller graph for this function:

SigGroupCleanup()

int SigGroupCleanup

(

DetectEngineCtx *

de_ctx

)

Definition at line 2275 of file detect-engine-build.c.

References de_ctx, and SigAddressCleanupStage1().

Referenced by DetectEngineCtxFree(), UTHMatchPackets(), and UTHPacketMatchSig().

Here is the call graph for this function:

Here is the caller graph for this function:

SignatureIsFilemagicInspecting()

int SignatureIsFilemagicInspecting

(

const Signature *

s

)

Check if a signature contains the filemagic keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 120 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_MAGIC.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureIsFileMd5Inspecting()

int SignatureIsFileMd5Inspecting

(

const Signature *

s

)

Check if a signature contains the filemd5 keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 139 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_MD5.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureIsFileSha1Inspecting()

int SignatureIsFileSha1Inspecting

(

const Signature *

s

)

Check if a signature contains the filesha1 keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 155 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_SHA1.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureIsFileSha256Inspecting()

int SignatureIsFileSha256Inspecting

(

const Signature *

s

)

Check if a signature contains the filesha256 keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 171 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_SHA256.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureIsFilesizeInspecting()

int SignatureIsFilesizeInspecting

(

const Signature *

s

)

Check if a signature contains the filesize keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 187 of file detect-engine-build.c.

References Signature_::file_flags, and FILE_SIG_NEED_SIZE.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureIsFilestoring()

int SignatureIsFilestoring

(

const Signature *

s

)

Check if a signature contains the filestore keyword.

Parameters

s

signature

Return values

0	no
1	yes

Definition at line 101 of file detect-engine-build.c.

References Signature_::flags, and SIG_FLAG_FILESTORE.

Referenced by SigGroupHeadSetupFiles().

Here is the caller graph for this function:

SignatureSetType()

void SignatureSetType	(	DetectEngineCtx *	de_ctx,
		Signature *	s
	)

Definition at line 1655 of file detect-engine-build.c.

References SignatureInitData_::buffer_index, SignatureInitData_::buffers, BUG_ON, de_ctx, DETECT_SM_LIST_MATCH, DETECT_SM_LIST_PMATCH, DetectEngineBufferTypeSupportsFramesGetById(), DetectEngineBufferTypeSupportsPacketGetById(), Signature_::flags, SignatureInitData_::hook, SignatureInitDataBuffer_::id, Signature_::id, Signature_::init_data, SCLogDebug, SCReturn, SIG_FLAG_APPLAYER, SIG_FLAG_REQUIRE_PACKET, SIG_FLAG_REQUIRE_STREAM, SIG_TYPE_APP_TX, SIG_TYPE_APPLAYER, SIG_TYPE_DEONLY, SIG_TYPE_IPONLY, SIG_TYPE_LIKE_IPONLY, SIG_TYPE_NOT_SET, SIG_TYPE_PDONLY, SIG_TYPE_PKT, SIG_TYPE_PKT_STREAM, SIG_TYPE_STREAM, SIGNATURE_HOOK_TYPE_APP, SignatureIsIPOnly(), SignatureInitData_::smlists, SignatureHook_::type, and Signature_::type.

Here is the call graph for this function:

SigPrepareStage1()

int SigPrepareStage1

(

DetectEngineCtx *

de_ctx

)

Preprocess signature, classify ip-only, etc, build sig array.

Parameters

de_ctx

Pointer to the Detection Engine Context

Return values

0	on success
-1	on failure

Definition at line 1733 of file detect-engine-build.c.

SigPrepareStage2()

int SigPrepareStage2

(

DetectEngineCtx *

de_ctx

)

Fill the global src group head, with the sigs included.

Parameters

de_ctx

Pointer to the Detection Engine Context whose Signatures have to be processed

Return values

0	On success
-1	On failure

Definition at line 1887 of file detect-engine-build.c.

References de_ctx, DetectEngineCtx_::flow_gh, SignatureInitData_::hook, Signature_::id, Signature_::init_data, DetectEngineCtx_::io_ctx, IPOnlyAddSignature(), IPOnlyInit(), IPOnlyPrepare(), IPOnlyPrint(), Signature_::next, SignatureHook_::ph, SignatureHook_::pkt, SCLogDebug, SIG_FLAG_TOCLIENT, SIG_FLAG_TOSERVER, DetectEngineCtx_::sig_list, SIG_TYPE_DEONLY, SIG_TYPE_IPONLY, SIG_TYPE_PKT, SIGNATURE_HOOK_PKT_PRE_FLOW, SIGNATURE_HOOK_PKT_PRE_STREAM, SIGNATURE_HOOK_TYPE_PKT, SignatureHook_::t, DetectEngineLookupFlow_::tcp, SignatureHook_::type, Signature_::type, and DetectEngineLookupFlow_::udp.

Referenced by SigGroupBuild().

Here is the call graph for this function:

Here is the caller graph for this function:

SigPrepareStage3()

int SigPrepareStage3

(

DetectEngineCtx *

de_ctx

)

Definition at line 1963 of file detect-engine-build.c.

References de_ctx.

Referenced by SigGroupBuild().

Here is the caller graph for this function:

SigPrepareStage4()

int SigPrepareStage4

(

DetectEngineCtx *

de_ctx

)

finalize preparing sgh's

Definition at line 2060 of file detect-engine-build.c.

References cnt, de_ctx, DetectEngineCtx_::decoder_event_sgh, SigGroupHead_::filestore_cnt, SigGroupHead_::id, SigGroupHead_::init, MpmStoreReportStats(), PrefilterSetupRuleGroup(), SCConfGetBool(), SCEnter, SCLogDebug, SCLogPerf, SCProfilingSghInitCounters(), SCReturnInt, DetectEngineCtx_::sgh_array, DetectEngineCtx_::sgh_array_cnt, SigGroupHeadHashFree(), SigGroupHeadInitDataFree(), and SigGroupHeadSetupFiles().

Referenced by SigGroupBuild().

Here is the call graph for this function:

Here is the caller graph for this function: