Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages
src

detect.h File Reference

#include "decode.h"
#include "rules.h"
#include "parser.h"
#include "log.h"
#include "event.h"

Go to the source code of this file.

Functions

int PassAction ()
int ActivateAction (Packet *, OptTreeNode *, Event *)
int AlertAction (Packet *, OptTreeNode *, Event *)
int DropAction (Packet *, OptTreeNode *, Event *)
int DynamicAction (Packet *, OptTreeNode *, Event *)
int LogAction (Packet *, OptTreeNode *, Event *)
int Preprocess (Packet *)
int Detect (Packet *)
void CallOutputPlugins (Packet *)
int EvalPacket (ListHead *, int, Packet *)
int EvalHeader (RuleTreeNode *, Packet *, int)
int EvalOpts (OptTreeNode *, Packet *)
void TriggerResponses (Packet *, OptTreeNode *)
int CheckAddrPort (IpAddrSet *, u_short, u_short, Packet *, u_int32_t, int)
static void DisableDetect (Packet *p)
int CheckBidirectional (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckSrcIP (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckDstIP (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckSrcIPNotEq (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckDstIPNotEq (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckSrcPortEqual (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckDstPortEqual (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckSrcPortNotEq (Packet *, struct _RuleTreeNode *, RuleFpList *)
int CheckDstPortNotEq (Packet *, struct _RuleTreeNode *, RuleFpList *)
int RuleListEnd (Packet *, struct _RuleTreeNode *, RuleFpList *)
int OptListEnd (Packet *, struct _OptTreeNode *, OptFpList *)
void CallLogPlugins (Packet *, char *, void *, Event *)
void CallAlertPlugins (Packet *, char *, void *, Event *)
void CallLogFuncs (Packet *, char *, ListHead *, Event *)
void CallAlertFuncs (Packet *, char *, ListHead *, Event *)
void ObfuscatePacket (Packet *p)

Variables

int do_detect

Function Documentation

int ActivateAction (  Packet *  ,
OptTreeNode *  ,
Event * 
) 
 

Definition at line 1466 of file detect.c.

References _OptTreeNode::activation_counter, active_dynamic_nodes, _RuleTreeNode::active_flag, _OptTreeNode::active_flag, CallAlertFuncs(), CallLogFuncs(), _RuleTreeNode::countdown, _OptTreeNode::countdown, DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::listhead, LogMessage(), _SigInfo::message, NULL, _OptTreeNode::OTN_activation_ptr, _OptTreeNode::rtn, _OptTreeNode::RTN_activation_ptr, and _OptTreeNode::sigInfo.

Referenced by fpLogEvent().

int AlertAction (  Packet *  ,
OptTreeNode *  ,
Event * 
) 
 

Definition at line 1498 of file detect.c.

References CallAlertFuncs(), CallLogFuncs(), CallSigOutputFuncs(), DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::listhead, _SigInfo::message, _OptTreeNode::outputFuncs, _OptTreeNode::rtn, and _OptTreeNode::sigInfo.

Referenced by fpLogEvent().

void CallAlertFuncs (  Packet *  ,
char *  ,
ListHead *  ,
Event * 
) 
 

Definition at line 343 of file detect.c.

References _PacketCount::alert_pkts, _ListHead::AlertList, _OutputFuncNode::arg, CallAlertPlugins(), event_id, _Event::event_id, _progvars::event_log_id, _Event::event_reference, _OutputFuncNode::func, _OutputFuncNode::next, NULL, ObfuscatePacket(), _progvars::obfuscation_flag, pc, pv, _Event::ref_time, sfthreshold_test(), _Event::sig_generator, and _Event::sig_id.

Referenced by ActivateAction(), AlertAction(), AlertIntermediateInfo(), DropAction(), GenerateSnortEvent(), PortscanPreprocFunction(), and SAlert().

void CallAlertPlugins (  Packet *  ,
char *  ,
void *  ,
Event * 
) 
 

Definition at line 416 of file detect.c.

References _PacketCount::alert_pkts, _OutputFuncNode::arg, DEBUG_DETECT, DEBUG_WRAP, _OutputFuncNode::func, _OutputFuncNode::next, NULL, ObfuscatePacket(), _progvars::obfuscation_flag, pc, and pv.

Referenced by CallAlertFuncs().

void CallLogFuncs (  Packet *  ,
char *  ,
ListHead *  ,
Event * 
) 
 

Definition at line 229 of file detect.c.

References _OutputFuncNode::arg, CallLogPlugins(), event_id, _Event::event_id, _progvars::event_log_id, _OutputFuncNode::func, _IPHdr::ip_dst, _IPHdr::ip_src, _Packet::iph, _PacketCount::log_pkts, _ListHead::LogList, _OutputFuncNode::next, NULL, ObfuscatePacket(), _progvars::obfuscation_flag, pc, _Packet::pkth, pv, _Event::ref_time, sfthreshold_test(), _Event::sig_generator, _Event::sig_id, and pcap_pkthdr::ts.

Referenced by ActivateAction(), AlertAction(), CheckTagging(), DropAction(), DynamicAction(), GenerateOpenPortEvent(), GenerateSnortEvent(), LogAction(), and LogTagData().

void CallLogPlugins (  Packet *  ,
char *  ,
void *  ,
Event * 
) 
 

Definition at line 302 of file detect.c.

References _OutputFuncNode::arg, _OutputFuncNode::func, _PacketCount::log_pkts, _OutputFuncNode::next, NULL, ObfuscatePacket(), _progvars::obfuscation_flag, pc, and pv.

Referenced by CallLogFuncs(), and ProcessPacket().

void CallOutputPlugins (  Packet *   ) 
 

int CheckAddrPort (  IpAddrSet *  ,
u_short  ,
u_short  ,
Packet *  ,
u_int32_t  ,
int 
) 
 

int CheckBidirectional (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 829 of file detect.c.

References CHECK_DST, CHECK_SRC, CheckAddrPort(), DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::dip, _RuleTreeNode::flags, _RuleTreeNode::hdp, _RuleTreeNode::hsp, INVERSE, _RuleTreeNode::ldp, _RuleTreeNode::lsp, and _RuleTreeNode::sip.

Referenced by SetupRTNFuncList().

int CheckDstIP (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1039 of file detect.c.

References _IpAddrSet::addr_flags, DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::dip, EXCEPT_DST_IP, EXCEPT_IP, _RuleTreeNode::flags, _IpAddrSet::ip_addr, _IPHdr::ip_dst, _IPHdr::ip_src, _Packet::iph, _IpAddrSet::netmask, _RuleFpList::next, _IpAddrSet::next, NULL, and _RuleFpList::RuleHeadFunc.

Referenced by AddrToFunc().

int CheckDstIPNotEq (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1115 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::dip, _IpAddrSet::ip_addr, _IPHdr::ip_dst, _Packet::iph, _IpAddrSet::netmask, _RuleFpList::next, _IpAddrSet::next, NULL, and _RuleFpList::RuleHeadFunc.

int CheckDstPortEqual (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1183 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _Packet::dp, _RuleTreeNode::hdp, _RuleTreeNode::ldp, _RuleFpList::next, and _RuleFpList::RuleHeadFunc.

Referenced by PortToFunc().

int CheckDstPortNotEq (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1203 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _Packet::dp, _RuleTreeNode::hdp, _RuleTreeNode::ldp, _RuleFpList::next, and _RuleFpList::RuleHeadFunc.

Referenced by PortToFunc().

int CheckSrcIP (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 923 of file detect.c.

References _IpAddrSet::addr_flags, DEBUG_DETECT, DEBUG_WRAP, EXCEPT_IP, EXCEPT_SRC_IP, _RuleTreeNode::flags, _IpAddrSet::ip_addr, _IPHdr::ip_src, _Packet::iph, _IpAddrSet::netmask, _RuleFpList::next, _IpAddrSet::next, NULL, _RuleFpList::RuleHeadFunc, and _RuleTreeNode::sip.

Referenced by AddrToFunc().

int CheckSrcIPNotEq (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1001 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _IpAddrSet::ip_addr, _IPHdr::ip_src, _Packet::iph, _IpAddrSet::netmask, _RuleFpList::next, _IpAddrSet::next, NULL, _RuleFpList::RuleHeadFunc, and _RuleTreeNode::sip.

int CheckSrcPortEqual (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1139 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::hsp, _RuleTreeNode::lsp, _RuleFpList::next, _RuleFpList::RuleHeadFunc, and _Packet::sp.

Referenced by PortToFunc().

int CheckSrcPortNotEq (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1161 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::hsp, _RuleTreeNode::lsp, _RuleFpList::next, _RuleFpList::RuleHeadFunc, and _Packet::sp.

Referenced by PortToFunc().

int Detect (  Packet *   ) 
 

Definition at line 450 of file detect.c.

References fpEvalPacket(), and NULL.

Referenced by Preprocess(), and SnortHttpInspect().

static void DisableDetect (  Packet *  p  )  [inline, static]
 

Definition at line 65 of file detect.h.

References do_detect, and _Packet::preprocessors.

Referenced by Frag2Defrag(), InsertFrag(), and ReassembleStream4().

int DropAction (  Packet *  ,
OptTreeNode *  ,
Event * 
) 
 

Definition at line 1532 of file detect.c.

References CallAlertFuncs(), CallLogFuncs(), DEBUG_DETECT, DEBUG_WRAP, InlineDrop(), _RuleTreeNode::listhead, _SigInfo::message, _Stream4Data::ms_inline_alerts, _Packet::packet_flags, PKT_INLINE_DROP, _OptTreeNode::rtn, _Session::session_flags, _OptTreeNode::sigInfo, SSNFLAG_MIDSTREAM, and _Packet::ssnptr.

Referenced by fpLogEvent().

int DynamicAction (  Packet *  ,
OptTreeNode *  ,
Event * 
) 
 

Definition at line 1730 of file detect.c.

References active_dynamic_nodes, _RuleTreeNode::active_flag, _OptTreeNode::active_flag, CallLogFuncs(), _OptTreeNode::countdown, _RuleTreeNode::countdown, DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::listhead, _SigInfo::message, _OptTreeNode::rtn, and _OptTreeNode::sigInfo.

Referenced by fpLogEvent().

int EvalHeader (  RuleTreeNode *  ,
Packet *  ,
int 
) 
 

int EvalOpts (  OptTreeNode *  ,
Packet * 
) 
 

int EvalPacket (  ListHead *  ,
int  ,
Packet * 
) 
 

int LogAction (  Packet *  ,
OptTreeNode *  ,
Event * 
) 
 

Definition at line 1760 of file detect.c.

References CallLogFuncs(), DEBUG_DETECT, DEBUG_WRAP, _RuleTreeNode::listhead, _SigInfo::message, _OptTreeNode::rtn, and _OptTreeNode::sigInfo.

Referenced by fpLogEvent().

void ObfuscatePacket (  Packet *  p  ) 
 

Definition at line 1776 of file detect.c.

References _progvars::homenet, _IPHdr::ip_dst, _IPHdr::ip_src, _Packet::iph, _progvars::netmask, _progvars::obfuscation_mask, _progvars::obfuscation_net, _Packet::packet_flags, PKT_OBFUSCATED, and pv.

Referenced by CallAlertFuncs(), CallAlertPlugins(), CallLogFuncs(), CallLogPlugins(), and CallSigOutputFuncs().

int OptListEnd (  Packet *  ,
struct _OptTreeNode *  ,
OptFpList * 
) 
 

Definition at line 1229 of file detect.c.

Referenced by ParseRuleOptions().

int PassAction (   ) 
 

Definition at line 1456 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _PacketCount::pass_pkts, and pc.

Referenced by fpLogEvent().

int Preprocess (  Packet *  p  ) 
 

See if we should go ahead and remove this flow from the flow_preprocessor -- cmg

Definition at line 107 of file detect.c.

References AlertFlushStream(), _Packet::bytes_to_inspect, check_tags_flag, CheckFlowShutdown(), CheckTagging(), _PreprocessFuncNode::context, _Packet::csum_flags, DEBUG_DETECT, DEBUG_WRAP, _HttpUri::decode_flags, Detect(), do_detect, _Packet::dsize, _PreprocessFuncNode::func, _PreprocessFuncNode::next, NULL, PP_ALL, _Packet::preprocessors, SnortEventqLog(), SnortEventqReset(), _Packet::ssnptr, and _Packet::uri_count.

Referenced by FlushStream(), and ProcessPacket().

int RuleListEnd (  Packet *  ,
struct _RuleTreeNode *  ,
RuleFpList * 
) 
 

Definition at line 1223 of file detect.c.

Referenced by SetupRTNFuncList().

void TriggerResponses (  Packet *  ,
OptTreeNode * 
) 
 

Definition at line 470 of file detect.c.

References DEBUG_DETECT, DEBUG_WRAP, _RspFpList::next, NULL, _RspFpList::ResponseFunc, and _OptTreeNode::rsp_func.

Referenced by fpLogEvent().

Variable Documentation

int do_detect
 

Definition at line 98 of file detect.c.

Generated on Sun May 14 14:51:22 2006 by  doxygen 1.4.2