suricata
detect-engine-port.h
Go to the documentation of this file.
1/* Copyright (C) 2007-2010 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18/**
19 * \file
20 *
21 * \author Victor Julien <victor@inliniac.net>
22 */
23
24#ifndef SURICATA_DETECT_ENGINE_PORT_H
25#define SURICATA_DETECT_ENGINE_PORT_H
26
27#include "interval-tree.h"
28#include "detect.h"
29
30typedef struct SCPortIntervalNode {
31 uint16_t port; /* low port of a port range */
32 uint16_t port2; /* high port of a port range */
33 uint16_t max; /* max value of the high port in the subtree rooted at this node */
34
35 struct SigGroupHead_ *sh; /* SGHs corresponding to this port */
36
37 IRB_ENTRY(SCPortIntervalNode) irb; /* parent entry of the interval tree */
39
40IRB_HEAD(PI, SCPortIntervalNode); /* head of the interval tree */
42 SCPortIntervalCompare); /* prototype definition of the interval tree */
43
44/* prototypes */
45int DetectPortParse(const DetectEngineCtx *, DetectPort **head, const char *str);
46
50
52
54
60
62
67
68#ifdef UNITTESTS
69void DetectPortTests(void);
70#endif
71
72#endif /* SURICATA_DETECT_ENGINE_PORT_H */
DetectPort * DetectPortInit(void)
Alloc a DetectPort structure and update counters.
DetectPort * DetectPortCopySingle(DetectEngineCtx *, DetectPort *)
Function that return a copy of DetectPort src sigs.
DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port)
Function that find the group matching port in a group head.
void DetectPortFree(const DetectEngineCtx *de_ctx, DetectPort *)
Free a DetectPort and its members.
void DetectPortPrintList(DetectPort *head)
Helper function used to print the list of ports present in this DetectPort list.
int DetectPortInsert(DetectEngineCtx *, DetectPort **, DetectPort *)
function for inserting a port group object. This also makes sure SigGroupContainer lists are handled ...
void DetectPortTests(void)
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
bool DetectPortListsAreEqual(DetectPort *list1, DetectPort *list2)
Checks if two port group lists are equal.
int DetectPortParse(const DetectEngineCtx *, DetectPort **head, const char *str)
Function for parsing port strings.
void DetectPortPrint(DetectPort *)
Helper function that print the DetectPort info.
int DetectPortCmp(DetectPort *, DetectPort *)
Function that compare port groups.
int DetectPortTestConfVars(void)
DetectPort * DetectPortHashLookup(DetectEngineCtx *de_ctx, DetectPort *dp)
Used to lookup a DetectPort hash from the detection engine context DetectPort hash table.
void DetectPortHashFree(DetectEngineCtx *de_ctx)
Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by DetectPortInit() function.
int DetectPortHashAdd(DetectEngineCtx *de_ctx, DetectPort *dp)
Adds a DetectPort to the detection engine context DetectPort hash table.
int DetectPortHashInit(DetectEngineCtx *de_ctx)
Initializes the hash table in the detection engine context to hold the DetectPort hash.
Flow * head
Definition flow-hash.h:1
DetectEngineCtx * de_ctx
#define IRB_HEAD(name, type)
#define IRB_PROTOTYPE(name, type, field, cmp)
main detection engine ctx
Definition detect.h:932
Port structure for detection engine.
Definition detect.h:220
struct SigGroupHead_ * sh
IRB_ENTRY(SCPortIntervalNode) irb
Container for matching data for a signature group.
Definition detect.h:1629
#define str(s)