parser.c File Reference

#include <sys/types.h>
#include <sys/stat.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>
#include <netdb.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <grp.h>
#include <pwd.h>
#include <unistd.h>
#include "src/preprocessors/flow/flow_print.h"
#include "rules.h"
#include "parser.h"
#include "plugbase.h"
#include "debug.h"
#include "util.h"
#include "mstring.h"
#include "detect.h"
#include "fpcreate.h"
#include "log.h"
#include "generators.h"
#include "tag.h"
#include "signature.h"
#include "sfthreshold.h"
#include "sfutil/sfthd.h"
#include "snort.h"
#include "inline.h"
#include "event_queue.h"
#include "asn1.h"

Go to the source code of this file.

Defines
#define	MAX_RULE_OPTIONS   256
#define	MAX_LINE_LENGTH   4096
Functions
void	ProcessHeadNode (RuleTreeNode *, ListHead *, int)
void	ParseSID (char *, OptTreeNode *)
void	ParseRev (char *, OptTreeNode *)
void	XferHeader (RuleTreeNode *, RuleTreeNode *)
void	DumpChain (RuleTreeNode *, char *, char *)
void	IntegrityCheck (RuleTreeNode *, char *, char *)
void	SetLinks (RuleTreeNode *, RuleTreeNode *)
int	ProcessIP (char *, RuleTreeNode *, int)
IpAddrSet *	AllocAddrNode (RuleTreeNode *, int)
int	TestHeader (RuleTreeNode *, RuleTreeNode *)
RuleTreeNode *	GetDynamicRTN (int, RuleTreeNode *)
OptTreeNode *	GetDynamicOTN (int, RuleTreeNode *)
void	AddrToFunc (RuleTreeNode *, int)
void	PortToFunc (RuleTreeNode *, int, int, int)
void	SetupRTNFuncList (RuleTreeNode *)
static void	ParsePortList (char *args)
void	ParseRulesFile (char *file, int inclevel)
int	ContinuationCheck (char *rule)
int	CheckRule (char *str)
void	DumpRuleChains ()
void	IntegrityCheckRules ()
void	ParseRule (FILE *rule_file, char *prule, int inclevel)
void	AddRuleFuncToList (int(*func)(Packet *, struct _RuleTreeNode *, struct _RuleFpList *), RuleTreeNode *rtn)
void	ParsePreprocessor (char *rule)
void	ParseOutputPlugin (char *rule)
void	ParseRuleOptions (char *rule, int rule_type, int protocol)
int	RuleType (char *func)
int	WhichProto (char *proto_str)
int	ParsePort (char *prule_port, u_short *hi_port, u_short *lo_port, char *proto, int *not_flag)
int	ConvPort (char *port, char *proto)
void	ParseMessage (char *msg)
void	ParseLogto (char *filename)
void	ParseActivates (char *act_num)
void	ParseActivatedBy (char *act_by)
void	ParseCount (char *num)
VarEntry *	VarAlloc ()
VarEntry *	VarDefine (char *name, char *value)
void	VarDelete (char *name)
char *	VarGet (char *name)
char *	ExpandVars (char *string)
void	LinkDynamicRules ()
void	ProcessAlertFileOption (char *filespec)
char *	ProcessFileOption (char *filespec)
void	ProcessFlowbitsSize (char **args, int nargs)
void	ProcessEventQueue (char **args, int nargs)
void	ProcessDetectionOptions (char **args, int nargs)
void	ProcessResetMac (char **args, int nargs)
void	ParseConfig (char *rule)
int	checkKeyword (char *keyword)
void	ParseRuleTypeDeclaration (FILE *rule_file, char *rule)
char *	ReadLine (FILE *file)
char *	VarSearch (char *name)
Variables
ListHead	Alert
ListHead	Log
ListHead	Pass
ListHead	Activation
ListHead	Dynamic
ListHead	Drop
ListHead	SDrop
ListHead	Reject
ListHead	RejectBoth
ListHead	RejectSrc
ListHead	RejectDst
ListHead	Reinject
RuleTreeNode *	rtn_tmp
OptTreeNode *	otn_tmp
ListHead *	head_tmp = NULL
RuleListNode *	RuleLists
VarEntry *	VarHead = NULL
char *	file_name
int	file_line
int	rule_count
int	head_count
int	opt_count
int	dynamic_rules_present
int	active_dynamic_nodes
unsigned int	giFlowbitSize
SNORT_EVENT_QUEUE	g_event_queue
KeywordXlateList *	KeywordList
PreprocessKeywordList *	PreprocessKeywords
OutputFuncNode *	AlertList
OutputFuncNode *	LogList
OutputFuncNode *	DropList

---

Define Documentation

#define MAX_LINE_LENGTH   4096

Definition at line 64 of file parser.c. Referenced by ParseRulesFile(), and ReadLine().

#define MAX_RULE_OPTIONS   256

Definition at line 63 of file parser.c. Referenced by ParseRuleOptions().

---

Function Documentation

void AddrToFunc (  RuleTreeNode *  , int  )

Definition at line 1339 of file parser.c. References AddRuleFuncToList(), ANY_DST_IP, ANY_SRC_IP, CheckDstIP(), CheckSrcIP(), DEBUG_CONFIGRULES, DEBUG_WRAP, DST, _RuleTreeNode::flags, and SRC. Referenced by SetupRTNFuncList().

void AddRuleFuncToList (  int(*)(Packet *, struct _RuleTreeNode *, struct _RuleFpList *)  func, RuleTreeNode *  rtn )

Definition at line 1242 of file parser.c. References DEBUG_CONFIGRULES, DEBUG_WRAP, _RuleFpList::next, NULL, _RuleTreeNode::rule_func, and _RuleFpList::RuleHeadFunc. Referenced by AddrToFunc(), PortToFunc(), and SetupRTNFuncList().

IpAddrSet * AllocAddrNode (  RuleTreeNode *  , int  )

Definition at line 2266 of file parser.c. References _RuleTreeNode::dip, DST, FatalError(), _IpAddrSet::next, NULL, _RuleTreeNode::sip, and SRC. Referenced by ProcessIP().

int checkKeyword (  char *  keyword  )

Definition at line 4270 of file parser.c. References _RuleListNode::name, _RuleListNode::next, NULL, RULE_UNKNOWN, RuleType(), and strcasecmp. Referenced by ParseRuleTypeDeclaration().

int CheckRule (  char *  str  )

Definition at line 370 of file parser.c. References index. Referenced by ParseRule().

int ContinuationCheck (  char *  rule  )

Definition at line 342 of file parser.c. References DEBUG_CONFIGRULES, and DEBUG_WRAP. Referenced by ParseRulesFile().

int ConvPort (  char *  port, char *  proto )

Definition at line 2445 of file parser.c. References FatalError(), file_line, file_name, and NULL. Referenced by ParsePort().

void DumpChain (  RuleTreeNode *  , char *  , char *  )

Definition at line 650 of file detect.c. References _IpAddrSet::addr_flags, ANY_DST_PORT, ANY_SRC_PORT, _OptTreeNode::chain_node_number, DEBUG_RULES, DEBUG_WRAP, _RuleTreeNode::dip, _RuleTreeNode::down, EXCEPT_DST_IP, EXCEPT_DST_PORT, EXCEPT_IP, EXCEPT_SRC_IP, EXCEPT_SRC_PORT, _RuleTreeNode::flags, _RuleTreeNode::hdp, _RuleTreeNode::head_node_number, _RuleTreeNode::hsp, _IpAddrSet::ip_addr, _RuleTreeNode::ldp, _RuleTreeNode::lsp, _IpAddrSet::netmask, _OptTreeNode::next, _IpAddrSet::next, NULL, _RuleTreeNode::right, _RuleTreeNode::sip, _OptTreeNode::type, and _RuleTreeNode::type. Referenced by DumpRuleChains().

void DumpRuleChains (   )

Definition at line 430 of file parser.c. References DumpChain(), _ListHead::IcmpList, _ListHead::IpList, _RuleListNode::name, _RuleListNode::next, NULL, _RuleListNode::RuleList, _ListHead::TcpList, and _ListHead::UdpList. Referenced by ParseRulesFile().

char* ExpandVars (  char *  string  )

Definition at line 3015 of file parser.c. References bzero, DEBUG_CONFIGRULES, DEBUG_WRAP, ErrorMessage(), FatalError(), file_line, file_name, NULL, PARSERULE_SIZE, and VarGet(). Referenced by ParseRule().

OptTreeNode * GetDynamicOTN (  int  , RuleTreeNode *  )

Definition at line 3250 of file parser.c. References _OptTreeNode::activated_by, _RuleTreeNode::down, _OptTreeNode::next, and NULL. Referenced by SetLinks().

RuleTreeNode * GetDynamicRTN (  int  , RuleTreeNode *  )

Definition at line 3221 of file parser.c. References _RuleTreeNode::activate_list, _ActivateList::activated_by, _ActivateList::next, NULL, and _RuleTreeNode::right. Referenced by SetLinks().

void IntegrityCheck (  RuleTreeNode *  , char *  , char *  )

Definition at line 766 of file detect.c. References DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::down, FatalError(), _OptTreeNode::next, _OptFpList::next, NULL, _OptTreeNode::opt_func, _OptFpList::OptTestFunc, pv, _progvars::quiet_flag, _RuleTreeNode::right, snprintf, and STD_BUF. Referenced by IntegrityCheckRules().

void IntegrityCheckRules (   )

Definition at line 446 of file parser.c. References DEBUG_CONFIGRULES, DEBUG_WRAP, _ListHead::IcmpList, IntegrityCheck(), _ListHead::IpList, _RuleListNode::name, _RuleListNode::next, NULL, pv, _progvars::quiet_flag, _RuleListNode::RuleList, _ListHead::TcpList, and _ListHead::UdpList. Referenced by ParseRulesFile().

void LinkDynamicRules (   )

Definition at line 3165 of file parser.c. References _ListHead::IcmpList, SetLinks(), _ListHead::TcpList, and _ListHead::UdpList. Referenced by ParseRulesFile().

void ParseActivatedBy (  char *  act_by  )

Definition at line 2670 of file parser.c. References _RuleTreeNode::activate_list, _ActivateList::activated_by, _OptTreeNode::activated_by, errno, FatalError(), _ActivateList::next, and NULL. Referenced by ParseRuleOptions().

void ParseActivates (  char *  act_num  )

Definition at line 2642 of file parser.c. References _OptTreeNode::activates. Referenced by ParseRuleOptions().

void ParseConfig (  char *  rule  )

Definition at line 3518 of file parser.c. References _progvars::alert_interface_flag, asn1_init_mem(), _progvars::assurance_mode, ASSURE_EST, bcopy, _progvars::char_data_flag, _progvars::checksums_mode, _progvars::chroot_dir, _progvars::daemon_flag, _progvars::data_flag, DEBUG_CONFIGRULES, DEBUG_INIT, DEBUG_WRAP, _DecoderFlags::decode_alerts, _progvars::decoder_flags, DO_ICMP_CHECKSUMS, DO_IP_CHECKSUMS, DO_TCP_CHECKSUMS, DO_UDP_CHECKSUMS, _DecoderFlags::drop_alerts, _DecoderFlags::drop_ipopt_decode, _DecoderFlags::drop_tcpopt_decode, _DecoderFlags::drop_tcpopt_experiment, _DecoderFlags::drop_tcpopt_obsolete, _DecoderFlags::drop_tcpopt_ttcp, ErrorMessage(), FatalError(), FatalPrintError(), file_line, file_name, FILEACCESSBITS, flow_set_daemon(), GenHomenet(), gr, groupid, groupname, _progvars::include_year, _progvars::interface, _DecoderFlags::ipopt_decode, _progvars::log_cmd_override, _progvars::log_dir, _progvars::log_mode, LOG_NONE, LogMessage(), _progvars::min_ttl, mSplit(), mSplitFree(), VarEntry::name, NULL, _progvars::obfuscation_flag, OpenPcap(), OrderRuleLists(), ParseClassificationConfig(), ParsePortList(), ParseReferenceSystemConfig(), pcap_close(), _progvars::pcap_cmd, pd, _progvars::pkt_cnt, _progvars::pkt_snaplen, PRINT_INTERFACE, ProcessAlertFileOption(), ProcessDetectionOptions(), ProcessEventQueue(), ProcessFlowbitsSize(), ProcessResetMac(), ProcessThresholdOptions(), _progvars::promisc_flag, pv, pw, _progvars::quiet_flag, read_infile(), _progvars::readfile, _progvars::readmode_flag, _progvars::rules_order_flag, _progvars::show2hdr_flag, snprintf, STD_BUF, strcasecmp, strlcpy, strtol(), _DecoderFlags::tcpopt_decode, _DecoderFlags::tcpopt_experiment, _DecoderFlags::tcpopt_obsolete, _DecoderFlags::tcpopt_ttcp, _progvars::use_utc, userid, username, _progvars::verbose_bytedump_flag, and _progvars::verbose_flag. Referenced by ParseRule().

void ParseCount (  char *  num  )

Definition at line 2719 of file parser.c. References _OptTreeNode::activation_counter, DEBUG_CONFIGRULES, and DEBUG_WRAP. Referenced by ParseRuleOptions().

void ParseLogto (  char *  filename  )

Definition at line 2596 of file parser.c. References bzero, index, _OptTreeNode::logto, and NULL. Referenced by ParseRuleOptions().

void ParseMessage (  char *  msg  )

Definition at line 2510 of file parser.c. References DEBUG_CONFIGRULES, DEBUG_WRAP, ErrorMessage(), file_line, file_name, index, _SigInfo::message, NULL, and _OptTreeNode::sigInfo. Referenced by ParseRuleOptions().

void ParseOutputPlugin (  char *  rule  )

Definition at line 1512 of file parser.c. References _progvars::alert_cmd_override, ErrorMessage(), FatalError(), file_line, file_name, _OutputKeywordNode::func, GetOutputPlugin(), _progvars::log_cmd_override, mSplit(), mSplitFree(), _OutputKeywordNode::node_type, NT_OUTPUT_ALERT, NT_OUTPUT_LOG, NT_OUTPUT_SPECIAL, NULL, and pv. Referenced by ParseRule(), and ParseRuleTypeDeclaration().

int ParsePort (  char *  prule_port, u_short *  hi_port, u_short *  lo_port, char *  proto, int *  not_flag )

Definition at line 2343 of file parser.c. References ConvPort(), FatalError(), file_line, file_name, index, mSplit(), mSplitFree(), NULL, strcasecmp, and VarGet(). Referenced by ParsePortList(), ParseRule(), and ScanParseIp().

void ParsePortList (  char *  args  )  [static]

Definition at line 4232 of file parser.c. References FatalError(), file_line, file_name, _progvars::ignore_ports, mSplit(), mSplitFree(), ParsePort(), pv, and WhichProto(). Referenced by ParseConfig().

void ParsePreprocessor (  char *  rule  )

Definition at line 1445 of file parser.c. References DEBUG_CONFIGRULES, DEBUG_WRAP, _PreprocessKeywordList::entry, FatalError(), _PreprocessKeywordNode::func, _PreprocessKeywordNode::keyword, mSplit(), mSplitFree(), _PreprocessKeywordList::next, NULL, and strcasecmp. Referenced by ParseRule().

void ParseRev (  char *  , OptTreeNode *  )

Definition at line 207 of file signature.c. Referenced by ParseRuleOptions().

void ParseRule (  FILE *  rule_file, char *  prule, int  inclevel )

Definition at line 488 of file parser.c. References ANY_DST_PORT, ANY_SRC_PORT, BIDIRECTIONAL, bzero, CheckRule(), DEBUG_CONFIGRULES, DEBUG_WRAP, DST, EXCEPT_DST_PORT, EXCEPT_SRC_PORT, ExpandVars(), FatalError(), file_line, file_name, InlineMode(), _RuleListNode::mode, mSplit(), mSplitFree(), _RuleListNode::name, _RuleListNode::next, NULL, ParseConfig(), ParseOutputPlugin(), ParsePort(), ParsePreprocessor(), PARSERULE_SIZE, ParseRuleOptions(), ParseRulesFile(), ParseRuleTypeDeclaration(), ParseSFSuppress(), ParseSFThreshold(), ProcessHeadNode(), ProcessIP(), RULE_ACTIVATE, RULE_ALERT, RULE_CONFIG, rule_count, RULE_DECLARE, RULE_DROP, RULE_DYNAMIC, RULE_INCLUDE, RULE_LOG, RULE_OUTPUT, RULE_PASS, RULE_PREPROCESS, RULE_REINJECT, RULE_REJECT, RULE_REJECTBOTH, RULE_REJECTDST, RULE_REJECTSRC, RULE_SDROP, RULE_SUPPRESS, RULE_THRESHOLD, RULE_UNKNOWN, RULE_VAR, _RuleListNode::RuleList, RuleType(), SRC, strcasecmp, strip(), VarDefine(), VarGet(), and WhichProto(). Referenced by ParseRulesFile().

void ParseRuleOptions (  char *  rule, int  rule_type, int  protocol )

Definition at line 1603 of file parser.c. References AddOptFuncToList(), bzero, _OptTreeNode::chain_node_number, DEBUG_CONFIGRULES, DEBUG_INIT, DEBUG_WRAP, _RuleTreeNode::down, dynamic_rules_present, _KeywordXlateList::entry, errno, _OptTreeNode::event_data, FatalError(), file_line, file_name, _KeywordXlate::func, THDX_STRUCT::gen_id, GENERATOR_SNORT_ENGINE, _SigInfo::id, index, _KeywordXlate::keyword, MAX_RULE_OPTIONS, mSplit(), mSplitFree(), _OptTreeNode::next, _KeywordXlateList::next, NULL, ONE_CHECK, opt_count, OptListEnd(), ParseActivatedBy(), ParseActivates(), ParseClassType(), ParseCount(), ParseLogto(), ParseMessage(), ParsePriority(), ParseReference(), ParseRev(), ParseSID(), ParseTag(), ParseThreshold2(), _OptTreeNode::proto_node, _OptTreeNode::rtn, RULE_DYNAMIC, sfthreshold_create(), _Event::sig_generator, THDX_STRUCT::sig_id, _OptTreeNode::sigInfo, _OptTreeNode::stateless, strcasecmp, THD_TOO_MANY_THDOBJ, and _OptTreeNode::type. Referenced by ParseRule().

void ParseRulesFile (  char *  file, int  inclevel )

Definition at line 151 of file parser.c. References bzero, _progvars::config_dir, ContinuationCheck(), DEBUG_CONFIGRULES, DEBUG_WRAP, DumpRuleChains(), dynamic_rules_present, errno, FatalError(), file_line, file_name, head_count, index, IntegrityCheckRules(), LinkDynamicRules(), LogMessage(), MAX_LINE_LENGTH, NULL, opt_count, ParseRule(), PARSERULE_SIZE, pv, _progvars::quiet_flag, rule_count, strlcat(), and strlcpy. Referenced by ParseRule(), and SnortMain().

void ParseRuleTypeDeclaration (  FILE *  rule_file, char *  rule )

Definition at line 4293 of file parser.c. References checkKeyword(), CreateRuleType(), DEBUG_CONFIGRULES, DEBUG_WRAP, FatalError(), file_line, file_name, mSplit(), mSplitFree(), NULL, _progvars::num_rule_types, ParseOutputPlugin(), pv, ReadLine(), RULE_ACTIVATE, RULE_ALERT, RULE_DYNAMIC, RULE_LOG, RULE_OUTPUT, RULE_PASS, RuleType(), and strcasecmp. Referenced by ParseRule().

void ParseSID (  char *  , OptTreeNode *  )

Definition at line 182 of file signature.c. Referenced by ParseRuleOptions().

void PortToFunc (  RuleTreeNode *  , int  , int  , int  )

Definition at line 1384 of file parser.c. References AddRuleFuncToList(), CheckDstPortEqual(), CheckDstPortNotEq(), CheckSrcPortEqual(), CheckSrcPortNotEq(), DEBUG_CONFIGRULES, DEBUG_WRAP, DST, and SRC. Referenced by SetupRTNFuncList().

void ProcessAlertFileOption (  char *  filespec  )

Definition at line 3280 of file parser.c. References _progvars::alert_filename, DEBUG_CONFIGRULES, DEBUG_WRAP, ProcessFileOption(), and pv. Referenced by ParseConfig().

void ProcessDetectionOptions (  char **  args, int  nargs )

Definition at line 3435 of file parser.c. References FatalError(), file_line, file_name, fpSetDebugMode(), fpSetDetectSearchMethod(), fpSetMaxQueueEvents(), fpSetStreamInsert(), and strcasecmp. Referenced by ParseConfig().

void ProcessEventQueue (  char **  args, int  nargs )

Definition at line 3355 of file parser.c. References FatalError(), file_line, file_name, s_SNORT_EVENT_QUEUE::log_events, s_SNORT_EVENT_QUEUE::max_events, s_SNORT_EVENT_QUEUE::order, SNORT_EVENTQ_CONTENT_LEN, SNORT_EVENTQ_PRIORITY, and strcasecmp. Referenced by ParseConfig().

char* ProcessFileOption (  char *  filespec  )

Definition at line 3289 of file parser.c. References buffer, DEBUG_CONFIGRULES, DEBUG_WRAP, FatalError(), _progvars::log_dir, NULL, pv, _progvars::quiet_flag, STD_BUF, strlcat(), strlcpy, and strstr(). Referenced by AlertCSVParseArgs(), ParseAlertFastArgs(), ParseAlertFullArgs(), and ProcessAlertFileOption().

void ProcessFlowbitsSize (  char **  args, int  nargs )

Definition at line 3334 of file parser.c. References FatalError(), file_line, file_name, giFlowbitSize, int(), and strtol(). Referenced by ParseConfig().

void ProcessHeadNode (  RuleTreeNode *  , ListHead *  , int  )

Definition at line 943 of file parser.c. References DEBUG_CONFIGRULES, DEBUG_WRAP, _RuleTreeNode::down, ETHERNET_TYPE_IP, EXCEPT_DST_PORT, FatalError(), _RuleTreeNode::flags, head_count, _RuleTreeNode::head_node_number, _ListHead::IcmpList, _ListHead::IpList, _RuleTreeNode::ldp, _RuleTreeNode::listhead, LogMessage(), NULL, _RuleTreeNode::right, SetupRTNFuncList(), _ListHead::TcpList, TestHeader(), _ListHead::UdpList, and XferHeader(). Referenced by ParseRule().

int ProcessIP (  char *  , RuleTreeNode *  , int  )

Definition at line 2145 of file parser.c. References AllocAddrNode(), ANY_DST_IP, ANY_SRC_IP, DEBUG_CONFIGRULES, DEBUG_WRAP, DST, EXCEPT_DST_IP, EXCEPT_SRC_IP, FatalError(), file_line, file_name, _RuleTreeNode::flags, _IpAddrSet::ip_addr, mSplit(), mSplitFree(), _IpAddrSet::netmask, NULL, ParseIP(), SRC, and VarGet(). Referenced by ParseRule().

void ProcessResetMac (  char **  args, int  nargs )

Definition at line 3491 of file parser.c. References FatalError(), file_line, file_name, mSplit(), NULL, pv, and strtoul(). Referenced by ParseConfig().

char* ReadLine (  FILE *  file  )

Definition at line 4393 of file parser.c. References bzero, file_line, file_name, index, LogMessage(), MAX_LINE_LENGTH, and NULL. Referenced by ParseRuleTypeDeclaration().

int RuleType (  char *  func  )

Definition at line 2030 of file parser.c. References FatalError(), file_line, file_name, NULL, RULE_ACTIVATE, RULE_ALERT, RULE_CONFIG, RULE_DECLARE, RULE_DROP, RULE_DYNAMIC, RULE_INCLUDE, RULE_LOG, RULE_OUTPUT, RULE_PASS, RULE_PREPROCESS, RULE_REINJECT, RULE_REJECT, RULE_REJECTBOTH, RULE_REJECTDST, RULE_REJECTSRC, RULE_SDROP, RULE_SUPPRESS, RULE_THRESHOLD, RULE_UNKNOWN, RULE_VAR, and strcasecmp. Referenced by checkKeyword(), ParseRule(), and ParseRuleTypeDeclaration().

void SetLinks (  RuleTreeNode *  , RuleTreeNode *  )

Definition at line 3188 of file parser.c. References _OptTreeNode::activates, _RuleTreeNode::down, GetDynamicOTN(), GetDynamicRTN(), _OptTreeNode::next, NULL, _OptTreeNode::OTN_activation_ptr, _RuleTreeNode::right, and _OptTreeNode::RTN_activation_ptr. Referenced by LinkDynamicRules().

void SetupRTNFuncList (  RuleTreeNode *   )

Definition at line 1281 of file parser.c. References AddrToFunc(), AddRuleFuncToList(), ANY_DST_PORT, ANY_SRC_PORT, BIDIRECTIONAL, CheckBidirectional(), DEBUG_CONFIGRULES, DEBUG_WRAP, DST, EXCEPT_DST_PORT, EXCEPT_SRC_PORT, _RuleTreeNode::flags, PortToFunc(), RuleListEnd(), and SRC. Referenced by ProcessHeadNode().

int TestHeader (  RuleTreeNode *  , RuleTreeNode *  )

Definition at line 2774 of file parser.c. References _IpAddrSet::addr_flags, _RuleTreeNode::dip, _RuleTreeNode::flags, _RuleTreeNode::hdp, _RuleTreeNode::hsp, _IpAddrSet::ip_addr, _RuleTreeNode::ldp, _RuleTreeNode::lsp, _IpAddrSet::netmask, _IpAddrSet::next, NULL, and _RuleTreeNode::sip. Referenced by ProcessHeadNode().

struct VarEntry* VarAlloc (   )

Definition at line 2840 of file parser.c. References FatalError(), and NULL. Referenced by VarDefine().

struct VarEntry* VarDefine (  char *  name, char *  value )

Definition at line 2864 of file parser.c. References FatalError(), file_line, file_name, VarEntry::flags, VarEntry::name, VarEntry::next, NULL, VarEntry::prev, strcasecmp, VarEntry::value, VAR_STATIC, and VarAlloc(). Referenced by DefineIfaceVar(), ParseCmdLine(), and ParseRule().

void VarDelete (  char *  name  )

Definition at line 2929 of file parser.c. References VarEntry::name, VarEntry::next, NULL, VarEntry::prev, strcasecmp, and VarEntry::value.

char* VarGet (  char *  name  )

Definition at line 2978 of file parser.c. References FatalError(), file_line, file_name, VarEntry::name, VarEntry::next, NULL, strcasecmp, and VarEntry::value. Referenced by ExpandVars(), IpAddrSetParse(), ParsePort(), ParseRule(), ParseSyslogArgs(), PortscanIgnoreParseIP(), PortscanParseIP(), ProcessIP(), ScanParseIp(), and ScanParsePort().

char* VarSearch (  char *  name  )

Definition at line 4431 of file parser.c. References VarEntry::name, VarEntry::next, NULL, strcasecmp, and VarEntry::value.

int WhichProto (  char *  proto_str  )

Definition at line 2117 of file parser.c. References ETHERNET_TYPE_ARP, ETHERNET_TYPE_IP, FatalError(), file_line, file_name, and strcasecmp. Referenced by ParsePortList(), and ParseRule().

void XferHeader (  RuleTreeNode *  , RuleTreeNode *  )

Definition at line 2746 of file parser.c. References _RuleTreeNode::dip, _RuleTreeNode::flags, _RuleTreeNode::hdp, _RuleTreeNode::hsp, _RuleTreeNode::ldp, _RuleTreeNode::lsp, _RuleTreeNode::not_dp_flag, _RuleTreeNode::not_sp_flag, _RuleTreeNode::sip, and _RuleTreeNode::type. Referenced by ProcessHeadNode().

---

Variable Documentation

ListHead Activation

Definition at line 69 of file parser.c.

int active_dynamic_nodes

Definition at line 95 of file parser.c.

ListHead Alert

Definition at line 66 of file parser.c.

OutputFuncNode* AlertList

Definition at line 587 of file plugbase.c.

ListHead Drop

Definition at line 71 of file parser.c.

OutputFuncNode* DropList

ListHead Dynamic

Definition at line 70 of file parser.c.

int dynamic_rules_present

Definition at line 94 of file parser.c. Referenced by ParseRuleOptions(), and ParseRulesFile().

int file_line

Definition at line 88 of file parser.c.

char* file_name

external globals from rules.c Definition at line 87 of file parser.c.

SNORT_EVENT_QUEUE g_event_queue

size of flowbits tracking Definition at line 28 of file event_queue.c.

unsigned int giFlowbitSize

Definition at line 78 of file spp_flow.c.

int head_count

Definition at line 91 of file parser.c. Referenced by ParseRulesFile(), and ProcessHeadNode().

ListHead* head_tmp = NULL

Definition at line 81 of file parser.c.

KeywordXlateList* KeywordList

Definition at line 145 of file plugbase.c.

ListHead Log

Definition at line 67 of file parser.c.

OutputFuncNode* LogList

Definition at line 588 of file plugbase.c.

int opt_count

Definition at line 92 of file parser.c. Referenced by DecodeIPOptions(), DecodeTCPOptions(), ParseRuleOptions(), and ParseRulesFile().

OptTreeNode* otn_tmp

Definition at line 80 of file parser.c.

ListHead Pass

Definition at line 68 of file parser.c.

PreprocessKeywordList* PreprocessKeywords

Definition at line 417 of file plugbase.c.

ListHead Reinject

Definition at line 77 of file parser.c.

ListHead Reject

Definition at line 73 of file parser.c.

ListHead RejectBoth

Definition at line 74 of file parser.c.

ListHead RejectDst

Definition at line 76 of file parser.c.

ListHead RejectSrc

Definition at line 75 of file parser.c.

RuleTreeNode* rtn_tmp

Definition at line 79 of file parser.c.

int rule_count

Definition at line 90 of file parser.c. Referenced by ParseRule(), and ParseRulesFile().

RuleListNode* RuleLists

Definition at line 83 of file parser.c. Referenced by fpCreateFastPacketDetection().

ListHead SDrop

Definition at line 72 of file parser.c.

struct VarEntry* VarHead = NULL

Definition at line 85 of file parser.c.

---