fpdetect.c File Reference

#include "snort.h"
#include "detect.h"
#include "debug.h"
#include "util.h"
#include "tag.h"
#include "rules.h"
#include "pcrm.h"
#include "fpcreate.h"
#include "fpdetect.h"
#include "mpse.h"
#include "bitop.h"
#include "perf-event.h"
#include "sfthreshold.h"
#include "event_queue.h"
#include "inline.h"
#include "sp_pattern_match.h"
#include "spp_frag3.h"

Go to the source code of this file.

Defines
#define	MAX_EVENT_MATCH   100
#define	FPSW
Functions
static INLINE int	fpEvalOTN (OptTreeNode *List, Packet *p)
static INLINE int	fpEvalRTN (RuleTreeNode *rtn, Packet *p, int check_ports)
static INLINE int	fpEvalHeader (PORT_GROUP *port_group, Packet *p, int check_ports)
static INLINE int	fpEvalRTNSW (RuleTreeNode *rtn, OptTreeNode *otn, Packet *p, int check_ports)
static INLINE int	fpEvalHeaderIp (Packet *p, int ip_proto)
static INLINE int	fpEvalHeaderIcmp (Packet *p)
static INLINE int	fpEvalHeaderTcp (Packet *p)
static INLINE int	fpEvalHeaderUdp (Packet *p)
static INLINE int	fpEvalHeaderSW (PORT_GROUP *port_group, Packet *p, int check_ports)
static int	otnx_match (void *id, int index, void *data)
static INLINE int	fpAddMatch (OTNX_MATCH_DATA *omd, OTNX *otnx, int pLen)
static INLINE int	fpAddSessionAlert (Packet *p, OTNX *otnx)
static INLINE int	fpSessionAlerted (Packet *p, OTNX *otnx)
int	OtnXMatchDataInitialize ()
int	fpSetDetectionOptions (FPDETECT *detect_options)
int	fpLogEvent (RuleTreeNode *rtn, OptTreeNode *otn, Packet *p)
static INLINE void	InitMatchInfo (OTNX_MATCH_DATA *o)
static INLINE int	fpFinalSelectEvent (OTNX_MATCH_DATA *o, Packet *p)
int	fpEvalPacket (Packet *p)
Variables
static FPDETECT *	fpDetect
PV	pv
int	active_dynamic_nodes
u_int16_t	event_id
char	check_tags_flag
OptTreeNode *	otn_tmp
u_int8_t	DecodeBuffer [DECODE_BLEN]
u_int8_t *	doe_ptr
static OTNX_MATCH_DATA	omd

---

Define Documentation

#define FPSW

Definition at line 72 of file fpdetect.c.

#define MAX_EVENT_MATCH   100

Definition at line 62 of file fpdetect.c. Referenced by fpAddMatch().

---

Function Documentation

static INLINE int fpAddMatch (  OTNX_MATCH_DATA *  omd, OTNX *  otnx, int  pLen )  [static]

Definition at line 410 of file fpdetect.c. References _RuleListNode::evalIndex, MATCH_INFO::iMatchCount, MATCH_INFO::iMatchIndex, MATCH_INFO::iMatchMaxLen, _RuleTreeNode::listhead, MATCH_INFO::MatchArray, OTNX_MATCH_DATA::matchInfo, MAX_EVENT_MATCH, _FPDETECT::max_queue_events, _otnx_::otn, _OptTreeNode::rtn, and _ListHead::ruleListNode. Referenced by fpEvalHeaderSW(), and otnx_match().

static INLINE int fpAddSessionAlert (  Packet *  p, OTNX *  otnx )  [static]

Definition at line 921 of file fpdetect.c. References _Session::alert_count, _Session::alert_gid, _Session::alert_sid, _SigInfo::generator, _SigInfo::id, MAX_SESSION_ALERTS, _otnx_::otn, _OptTreeNode::sigInfo, and _Packet::ssnptr. Referenced by fpFinalSelectEvent().

static INLINE int fpEvalHeader (  PORT_GROUP *  port_group, Packet *  p, int  check_ports )  [static]

Definition at line 996 of file fpdetect.c. References doe_ptr, fpEvalOTN(), fpEvalRTN(), fpLogEvent(), NULL, _otnx_::otn, PORT_GROUP::pgHead, PORT_GROUP::pgHeadNC, _rule_node_::rnNext, _rule_node_::rnRuleData, and _otnx_::rtn. Referenced by fpEvalHeaderIcmp(), and fpEvalHeaderIp().

static INLINE int fpEvalHeaderIcmp (  Packet *  p  )  [static]

Definition at line 1404 of file fpdetect.c. References fpEvalHeader(), fpEvalHeaderSW(), fpFinalSelectEvent(), _Packet::icmph, InitMatchInfo(), prmFindRuleGroupIcmp(), and _ICMPHdr::type. Referenced by fpEvalPacket().

static INLINE int fpEvalHeaderIp (  Packet *  p, int  ip_proto )  [static]

Definition at line 1457 of file fpdetect.c. References fpEvalHeader(), fpEvalHeaderSW(), fpFinalSelectEvent(), InitMatchInfo(), and prmFindRuleGroupIp(). Referenced by fpEvalPacket().

static INLINE int fpEvalHeaderSW (  PORT_GROUP *  port_group, Packet *  p, int  check_ports )  [static]

Definition at line 1084 of file fpdetect.c. References _Packet::alt_dsize, boResetBITOP(), PORT_GROUP::boRuleNodeID, OTNX_MATCH_DATA::check_ports, _Packet::data, _HttpUri::decode_flags, DecodeBuffer, doe_ptr, _Packet::dsize, fpAddMatch(), fpEvalOTN(), fpEvalRTN(), HTTPURI_PIPELINE_REQ, _FPDETECT::inspect_stream_insert, mpseSearch(), mpseSetRuleMask(), NULL, _otnx_::otn, otnx_match(), OTNX_MATCH_DATA::p, _Packet::packet_flags, OTNX_MATCH_DATA::pg, PORT_GROUP::pgHeadNC, PORT_GROUP::pgNQEvents, PORT_GROUP::pgPatData, PORT_GROUP::pgPatDataUri, PORT_GROUP::pgQEvents, PKT_ALT_DECODE, PKT_STREAM_INSERT, _rule_node_::rnNext, _rule_node_::rnRuleData, _otnx_::rtn, UpdateNQEvents(), UpdateQEvents(), _HttpUri::uri, _Packet::uri_count, URI_COUNT, and UriBufs. Referenced by fpEvalHeaderIcmp(), fpEvalHeaderIp(), fpEvalHeaderTcp(), and fpEvalHeaderUdp().

static INLINE int fpEvalHeaderTcp (  Packet *  p  )  [static]

Definition at line 1342 of file fpdetect.c. References _Packet::dp, fpEvalHeaderSW(), fpFinalSelectEvent(), InitMatchInfo(), prmFindRuleGroupTcp(), and _Packet::sp. Referenced by fpEvalPacket().

static INLINE int fpEvalHeaderUdp (  Packet *  p  )  [static]

Definition at line 1280 of file fpdetect.c. References _Packet::dp, fpEvalHeaderSW(), fpFinalSelectEvent(), InitMatchInfo(), prmFindRuleGroupUdp(), and _Packet::sp. Referenced by fpEvalPacket().

static INLINE int fpEvalOTN (  OptTreeNode *  List, Packet *  p )  [static]

Definition at line 475 of file fpdetect.c. References _OptTreeNode::active_flag, _runtime_config::capabilities, _OptTreeNode::chain_node_number, DEBUG_DETECT, DEBUG_WRAP, _OptTreeNode::established, FatalError(), _SigInfo::id, InlineMode(), NULL, _OptTreeNode::opt_func, _OptFpList::OptTestFunc, _Packet::packet_flags, PKT_STREAM_EST, _OptTreeNode::rtn, RULE_DROP, RULE_DYNAMIC, RULE_SDROP, _Session::session_flags, _OptTreeNode::sigInfo, snort_runtime, SSNFLAG_MIDSTREAM, _Packet::ssnptr, _Capabilities::stateful_inspection, _RuleTreeNode::type, _OptTreeNode::type, and _OptTreeNode::unestablished. Referenced by fpEvalHeader(), fpEvalHeaderSW(), and fpEvalRTNSW().

int fpEvalPacket (  Packet *  p  )

Definition at line 1533 of file fpdetect.c. References DEBUG_DETECT, DEBUG_WRAP, fpEvalHeaderIcmp(), fpEvalHeaderIp(), fpEvalHeaderTcp(), fpEvalHeaderUdp(), _Packet::icmph, _IPHdr::ip_proto, _Packet::iph, NULL, _Packet::tcph, and _Packet::udph. Referenced by Detect().

static INLINE int fpEvalRTN (  RuleTreeNode *  rtn, Packet *  p, int  check_ports )  [static]

Definition at line 579 of file fpdetect.c. References active_dynamic_nodes, _RuleTreeNode::active_flag, BIDIRECTIONAL, DEBUG_DETECT, DEBUG_WRAP, _Packet::dp, EXCEPT_DST_PORT, _RuleTreeNode::flags, _RuleTreeNode::head_node_number, _RuleTreeNode::ldp, NULL, RULE_DYNAMIC, _RuleTreeNode::rule_func, _RuleFpList::RuleHeadFunc, and _RuleTreeNode::type. Referenced by fpEvalHeader(), and fpEvalHeaderSW().

static INLINE int fpEvalRTNSW (  RuleTreeNode *  rtn, OptTreeNode *  otn, Packet *  p, int  check_ports )  [static]

Definition at line 655 of file fpdetect.c. References active_dynamic_nodes, _RuleTreeNode::active_flag, BIDIRECTIONAL, DEBUG_DETECT, DEBUG_WRAP, doe_ptr, _Packet::dp, EXCEPT_DST_PORT, _RuleTreeNode::flags, fpEvalOTN(), _RuleTreeNode::head_node_number, _RuleTreeNode::ldp, NULL, RULE_DYNAMIC, _RuleTreeNode::rule_func, _RuleFpList::RuleHeadFunc, and _RuleTreeNode::type. Referenced by otnx_match().

static INLINE int fpFinalSelectEvent (  OTNX_MATCH_DATA *  o, Packet *  p )  [static]

Definition at line 842 of file fpdetect.c. References _SigInfo::class_id, fpAddFragAlert(), fpAddSessionAlert(), fpFragAlerted(), fpSessionAlerted(), _Packet::fragtracker, _SigInfo::generator, _SigInfo::id, MATCH_INFO::iMatchCount, OTNX_MATCH_DATA::iMatchInfoArraySize, MATCH_INFO::MatchArray, OTNX_MATCH_DATA::matchInfo, _SigInfo::message, NULL, _otnx_::otn, _SigInfo::priority, _SigInfo::rev, _OptTreeNode::sigInfo, SnortEventqAdd(), and _Packet::ssnptr. Referenced by fpEvalHeaderIcmp(), fpEvalHeaderIp(), fpEvalHeaderTcp(), and fpEvalHeaderUdp().

int fpLogEvent (  RuleTreeNode *  rtn, OptTreeNode *  otn, Packet *  p )

Definition at line 210 of file fpdetect.c. References ActivateAction(), AlertAction(), _progvars::assurance_mode, ASSURE_EST, check_tags_flag, DEBUG_DETECT, DEBUG_WRAP, DropAction(), DynamicAction(), _OptTreeNode::event_data, event_id, InlineDrop(), InlineMode(), _IPHdr::ip_dst, _IPHdr::ip_src, _Packet::iph, LogAction(), _Packet::packet_flags, PassAction(), PKT_REBUILT_STREAM, PKT_STREAM_UNEST_UNI, _Packet::pkth, _Event::ref_time, RULE_ACTIVATE, RULE_ALERT, RULE_DROP, RULE_DYNAMIC, RULE_LOG, RULE_PASS, RULE_REINJECT, RULE_REJECT, RULE_REJECTBOTH, RULE_REJECTDST, RULE_REJECTSRC, RULE_SDROP, SetTags(), sfthreshold_test(), _Event::sig_generator, _Event::sig_id, _OptTreeNode::stateless, TriggerResponses(), pcap_pkthdr::ts, and _RuleTreeNode::type. Referenced by fpEvalHeader(), and LogSnortEvents().

static INLINE int fpSessionAlerted (  Packet *  p, OTNX *  otnx )  [static]

Definition at line 963 of file fpdetect.c. References _Session::alert_gid, _Session::alert_sid, _SigInfo::generator, _SigInfo::id, _otnx_::otn, PKT_REBUILT_STREAM, and _OptTreeNode::sigInfo. Referenced by fpFinalSelectEvent().

int fpSetDetectionOptions (  FPDETECT *  detect_options  )

Definition at line 188 of file fpdetect.c. Referenced by fpInitDetectionEngine().

static INLINE void InitMatchInfo (  OTNX_MATCH_DATA *  o  )  [static]

Definition at line 371 of file fpdetect.c. References MATCH_INFO::iMatchCount, MATCH_INFO::iMatchIndex, OTNX_MATCH_DATA::iMatchInfoArraySize, MATCH_INFO::iMatchMaxLen, and OTNX_MATCH_DATA::matchInfo. Referenced by fpEvalHeaderIcmp(), fpEvalHeaderIp(), fpEvalHeaderTcp(), and fpEvalHeaderUdp().

static int otnx_match (  void *  id, int  index, void *  data )  [static]

Definition at line 749 of file fpdetect.c. References boIsBitSet(), PORT_GROUP::boRuleNodeID, boSetBit(), OTNX_MATCH_DATA::check_ports, DEBUG_DETECT, DEBUG_WRAP, fpAddMatch(), fpEvalRTNSW(), _SigInfo::id, _rule_node_::iRuleNodeID, _otnx_::otn, OTNX_MATCH_DATA::p, _PatternMatchData::pattern_size, _pmx_::PatternMatchData, OTNX_MATCH_DATA::pg, PORT_GROUP::pgNQEvents, PORT_GROUP::pgQEvents, _rule_node_::rnRuleData, _otnx_::rtn, _pmx_::RuleNode, _OptTreeNode::sigInfo, UpdateNQEvents(), and UpdateQEvents(). Referenced by fpEvalHeaderSW().

int OtnXMatchDataInitialize (   )

Definition at line 160 of file fpdetect.c. References FatalError(), OTNX_MATCH_DATA::iMatchInfoArraySize, OTNX_MATCH_DATA::matchInfo, and _progvars::num_rule_types. Referenced by SnortMain().

---

Variable Documentation

int active_dynamic_nodes

Definition at line 95 of file parser.c.

char check_tags_flag

Definition at line 100 of file detect.c.

u_int8_t DecodeBuffer[DECODE_BLEN]

Definition at line 45 of file decode.c.

u_int8_t* doe_ptr

Definition at line 72 of file sp_pattern_match.c.

u_int16_t event_id

Definition at line 99 of file detect.c.

FPDETECT* fpDetect [static]

Definition at line 86 of file fpdetect.c.

OTNX_MATCH_DATA omd [static]

Definition at line 157 of file fpdetect.c.

OptTreeNode* otn_tmp

Definition at line 80 of file parser.c.

PV pv

Definition at line 129 of file snort.c. Referenced by AlertCSVInit(), AlertFast(), AlertFastInit(), AlertFull(), AlertFullInit(), AlertSyslog(), AlertSyslogInit(), AlertUnixSockInit(), CallAlertFuncs(), CallAlertPlugins(), CallLogFuncs(), CallLogPlugins(), CallSigOutputFuncs(), CheckFromClient(), CheckFromServer(), CheckLogDir(), CreatePidFile(), CreateRuleType(), DecodeARP(), DecodeChdlcPkt(), DecodeEAP(), DecodeEapol(), DecodeEapolKey(), DecodeEthPkt(), DecodeFDDIPkt(), DecodeICMP(), DecodeIEEE80211Pkt(), DecodeIP(), DecodeIPOnly(), DecodeIPOptions(), DecodeNullPkt(), DecodeOldPflog(), DecodePflog(), DecodePPPoEPkt(), DecodePppPkt(), DecodePppPktEncapsulated(), DecodePppSerialPkt(), DecodeTCP(), DecodeTCPOptions(), DecodeTRPkt(), DecodeUDP(), DecodeVlan(), DestinationIpIsHomenet(), DropStats(), DumpOutputPlugins(), DumpPlugIns(), DumpPreprocessors(), ErrorMessage(), FatalError(), FlowCleanExit(), FlowPreprocessor(), FlowPSCleanExit(), FlowPSOutputConfig(), Frag2Defrag(), Frag3Defrag(), GenHomenet(), GenObfuscationMask(), GetCurrentTimestamp(), GetPktDropStats(), GetTimestamp(), GetUniqueName(), InitDecoderFlags(), InitOutputPlugins(), InitPlugIns(), InitPreprocessors(), IntegrityCheck(), IntegrityCheckRules(), IPHdrTests(), LogAsciiInit(), LogMessage(), LogNullInit(), LogStream(), NotForStream4(), ObfuscatePacket(), OldUnifiedLogPacketAlert(), OpenAlertFile(), OpenAlertSock(), OpenLogFile(), OpenSessionFile(), OpenStatsFile(), ParseConfig(), ParseFrag2Args(), ParseOutputPlugin(), ParsePerfMonitorArgs(), ParsePortList(), ParsePortscanArgs(), ParseRulesFile(), ParseRuleTypeDeclaration(), ParseScanmungeArgs(), ParseSyslogArgs(), PortscanPreprocFunction(), Print2ndHeader(), PrintEapolPkt(), PrintError(), PrintIPHeader(), PrintIPPkt(), PrintNetData(), PrintWifiPkt(), ProcessAlertFileOption(), ProcessFileOption(), ProcessPerfMonitor(), ProcessResetMac(), ReassembleStream4(), SetEvent(), SourceIpIsHomenet(), Stream4Init(), ts_print(), UnifiedAlertInit(), UnifiedInit(), UnifiedInitAlertFile(), UnifiedInitFile(), UnifiedInitLogFile(), UnifiedLogInit(), and vsyslog().

---