/src/detect-engine-state.h

https://github.com/decanio/suricata-tilera · C Header · 167 lines · 86 code · 21 blank · 60 comment · 0 complexity · f39055f6ab546ccdd49b075a4bded5be MD5 · raw file

  1. /* Copyright (C) 2007-2011 Open Information Security Foundation
  2. *
  3. * You can copy, redistribute or modify this Program under the terms of
  4. * the GNU General Public License version 2 as published by the Free
  5. * Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * version 2 along with this program; if not, write to the Free Software
  14. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  15. * 02110-1301, USA.
  16. */
  17. /**
  18. * \ingroup sigstate
  19. *
  20. * @{
  21. */
  22. /**
  23. * \file
  24. *
  25. * \brief Data structures and function prototypes for keeping
  26. * state for the detection engine.
  27. *
  28. * \author Victor Julien <victor@inliniac.net>
  29. */
  30. /* On DeState and locking.
  31. *
  32. * The DeState is part of a flow, but it can't be protected by the flow lock.
  33. * Reason is we need to lock the DeState data for an entire detection run,
  34. * as we're looping through on "continued" detection and rely on only a single
  35. * detection instance setting it up on first run. We can't keep the entire flow
  36. * locked during detection for performance reasons, it would slow us down too
  37. * much.
  38. *
  39. * So a new lock was introduced. The only part of the process where we need
  40. * the flow lock is obviously when we're getting/setting the de_state ptr from
  41. * to the flow.
  42. */
  43. #ifndef __DETECT_ENGINE_STATE_H__
  44. #define __DETECT_ENGINE_STATE_H__
  45. /** number of DeStateStoreItem's in one DeStateStore object */
  46. #define DE_STATE_CHUNK_SIZE 15
  47. /* per stored sig flags */
  48. #define DE_STATE_FLAG_PAYLOAD_MATCH 1 /**< payload part of the sig matched */
  49. #define DE_STATE_FLAG_URI_MATCH 1 << 1 /**< uri part of the sig matched */
  50. #define DE_STATE_FLAG_DCE_MATCH 1 << 2 /**< dce payload inspection part matched */
  51. #define DE_STATE_FLAG_HCBD_MATCH 1 << 3 /**< hcbd payload inspection part matched */
  52. #define DE_STATE_FLAG_HSBD_MATCH 1 << 4 /**< hcbd payload inspection part matched */
  53. #define DE_STATE_FLAG_HHD_MATCH 1 << 5 /**< hhd payload inspection part matched */
  54. #define DE_STATE_FLAG_HRHD_MATCH 1 << 6 /**< hrhd payload inspection part matched */
  55. #define DE_STATE_FLAG_HMD_MATCH 1 << 7 /**< hmd payload inspection part matched */
  56. #define DE_STATE_FLAG_HCD_MATCH 1 << 8 /**< hcd payload inspection part matched */
  57. #define DE_STATE_FLAG_HRUD_MATCH 1 << 9 /**< hrud payload inspection part matched */
  58. #define DE_STATE_FLAG_FILE_TC_MATCH 1 << 10
  59. #define DE_STATE_FLAG_FILE_TS_MATCH 1 << 11
  60. #define DE_STATE_FLAG_FULL_MATCH 1 << 12 /**< sig already fully matched */
  61. #define DE_STATE_FLAG_SIG_CANT_MATCH 1 << 13 /**< signature has no chance of matching */
  62. #define DE_STATE_FLAG_HSMD_MATCH 1 << 14 /**< hsmd payload inspection part matched */
  63. #define DE_STATE_FLAG_HSCD_MATCH 1 << 15 /**< hscd payload inspection part matched */
  64. #define DE_STATE_FLAG_HUAD_MATCH 1 << 16 /**< huad payload inspection part matched */
  65. #define DE_STATE_FLAG_HHHD_MATCH 1 << 17 /**< hhhd payload inspection part matched */
  66. #define DE_STATE_FLAG_HRHHD_MATCH 1 << 18 /**< hrhhd payload inspection part matched */
  67. #define DE_STATE_FLAG_URI_INSPECT DE_STATE_FLAG_URI_MATCH /**< uri part of the sig inspected */
  68. #define DE_STATE_FLAG_DCE_INSPECT DE_STATE_FLAG_DCE_MATCH /**< dce payload inspection part inspected */
  69. #define DE_STATE_FLAG_HCBD_INSPECT DE_STATE_FLAG_HCBD_MATCH /**< hcbd payload inspection part inspected */
  70. #define DE_STATE_FLAG_HSBD_INSPECT DE_STATE_FLAG_HSBD_MATCH /**< hsbd payload inspection part inspected */
  71. #define DE_STATE_FLAG_HHD_INSPECT DE_STATE_FLAG_HHD_MATCH /**< hhd payload inspection part inspected */
  72. #define DE_STATE_FLAG_HRHD_INSPECT DE_STATE_FLAG_HRHD_MATCH /**< hrhd payload inspection part inspected */
  73. #define DE_STATE_FLAG_HMD_INSPECT DE_STATE_FLAG_HMD_MATCH /**< hmd payload inspection part inspected */
  74. #define DE_STATE_FLAG_HCD_INSPECT DE_STATE_FLAG_HCD_MATCH /**< hcd payload inspection part inspected */
  75. #define DE_STATE_FLAG_HRUD_INSPECT DE_STATE_FLAG_HRUD_MATCH /**< hrud payload inspection part inspected */
  76. #define DE_STATE_FLAG_FILE_TC_INSPECT DE_STATE_FLAG_FILE_TC_MATCH
  77. #define DE_STATE_FLAG_FILE_TS_INSPECT DE_STATE_FLAG_FILE_TS_MATCH
  78. #define DE_STATE_FLAG_HSMD_INSPECT DE_STATE_FLAG_HSMD_MATCH /**< hsmd payload inspection part inspected */
  79. #define DE_STATE_FLAG_HSCD_INSPECT DE_STATE_FLAG_HSCD_MATCH /**< hscd payload inspection part inspected */
  80. #define DE_STATE_FLAG_HUAD_INSPECT DE_STATE_FLAG_HUAD_MATCH /**< huad payload inspection part inspected */
  81. #define DE_STATE_FLAG_HHHD_INSPECT DE_STATE_FLAG_HHHD_MATCH /**< hhhd payload inspection part inspected */
  82. #define DE_STATE_FLAG_HRHHD_INSPECT DE_STATE_FLAG_HRHHD_MATCH /**< hrhhd payload inspection part inspected */
  83. /* state flags */
  84. #define DE_STATE_FILE_STORE_DISABLED 0x0001
  85. #define DE_STATE_FILE_TC_NEW 0x0002
  86. #define DE_STATE_FILE_TS_NEW 0x0004
  87. /** per signature detection engine state */
  88. typedef enum {
  89. DE_STATE_MATCH_NOSTATE = 0, /**< no state for this sig*/
  90. DE_STATE_MATCH_FULL, /**< sig already fully matched */
  91. DE_STATE_MATCH_PARTIAL, /**< partial state match */
  92. DE_STATE_MATCH_NEW, /**< new (full) match this run */
  93. DE_STATE_MATCH_NOMATCH, /**< not a match */
  94. } DeStateMatchResult;
  95. /** \brief State storage for a single signature */
  96. typedef struct DeStateStoreItem_ {
  97. SigIntId sid; /**< Signature internal id to store the state for (16 or
  98. * 32 bit depending on how SigIntId is defined). */
  99. uint32_t flags; /**< flags */
  100. SigMatch *nm; /**< next sig match to try, or null if done */
  101. } DeStateStoreItem;
  102. /** \brief State store "chunk" for x number of signature */
  103. typedef struct DeStateStore_ {
  104. DeStateStoreItem store[DE_STATE_CHUNK_SIZE]; /**< array of storage objects */
  105. struct DeStateStore_ *next; /**< ptr to the next array */
  106. #ifdef __tile__
  107. struct DeStateStore_ *pool_next; /**< ptr to the next array */
  108. #endif
  109. } DeStateStore;
  110. /** \brief State store main object */
  111. typedef struct DetectEngineState_ {
  112. DeStateStore *head; /**< signature state storage */
  113. DeStateStore *tail; /**< tail item of the storage list */
  114. SigIntId cnt; /**< number of sigs in the storage */
  115. uint16_t toclient_version; /**< app layer state "version" inspected
  116. * last in to client direction */
  117. uint16_t toserver_version; /**< app layer state "version" inspected
  118. * last in to server direction */
  119. uint16_t toclient_filestore_cnt;/**< number of sigs with filestore that
  120. * cannot match in to client direction. */
  121. uint16_t toserver_filestore_cnt;/**< number of sigs with filestore that
  122. * cannot match in to server direction. */
  123. uint16_t flags;
  124. #ifdef __tile__
  125. struct DetectEngineState_ *pool_next;
  126. #endif
  127. } DetectEngineState;
  128. void DeStateRegisterTests(void);
  129. //static DeStateStore *DeStateStoreAlloc(void);
  130. //static void DeStateStoreFree(DeStateStore *);
  131. void DetectEngineStateReset(DetectEngineState *state);
  132. //DetectEngineState *DetectEngineStateAlloc(void);
  133. void DetectEngineStateFree(DetectEngineState *);
  134. int DeStateFlowHasState(Flow *, uint8_t, uint16_t);
  135. int DeStateDetectStartDetection(ThreadVars *, DetectEngineCtx *,
  136. DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *,
  137. uint16_t, uint16_t);
  138. int DeStateDetectContinueDetection(ThreadVars *, DetectEngineCtx *,
  139. DetectEngineThreadCtx *, Flow *, uint8_t, void *, uint16_t,
  140. uint16_t);
  141. const char *DeStateMatchResultToString(DeStateMatchResult);
  142. int DeStateUpdateInspectTransactionId(Flow *, char);
  143. #endif /* __DETECT_ENGINE_STATE_H__ */
  144. /**
  145. * @}
  146. */