|
|
|
|
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
|
|
|
|
*
|
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
|
* Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
|
* 02110-1301, USA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \file
|
|
|
|
|
*
|
|
|
|
|
* \author Victor Julien <victor@inliniac.net>
|
|
|
|
|
* \author Breno Silva <breno.silva@gmail.com>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef __DETECT_FLOWBITS_H__
|
|
|
|
|
#define __DETECT_FLOWBITS_H__
|
|
|
|
|
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_SET 0
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_TOGGLE 1
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_UNSET 2
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_ISNOTSET 3
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_ISSET 4
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_NOALERT 5
|
|
|
|
|
#define DETECT_FLOWBITS_CMD_MAX 6
|
|
|
|
|
|
|
|
|
|
typedef struct DetectFlowbitsData_ {
|
var-names: expose outside of detect engine
Until now variable names, such as flowbit names, were local to a detect
engine. This made sense as they were only ever used in that context.
For the purpose of logging these names, this needs a different approach.
The loggers live outside of the detect engine. Also, in the case of
reloads and multi-tenancy, there are even multiple detect engines, so
it would be even more tricky to access them from the outside.
This patch brings a new approach. A any time, there is a single active
hash table mapping the variable names and their id's. For multiple
tenants the table is shared between tenants.
The table is set up in a 'staging' area, where locking makes sure that
multiple loading threads don't mess things up. Then when the preparing
of a detection engine is ready, but before the detect threads are made
aware of the new detect engine, the active varname hash is swapped with
the staging instance.
For this to work, all the mappings from the 'current' or active mapping
are added to the staging table.
After the threads have reloaded and the new detection engine is active,
the old table can be freed.
For multi tenancy things are similar. The staging area is used for
setting up until the new detection engines / tenants are applied to
the system.
This patch also changes the variable 'id'/'idx' field to uint32_t. Due
to data structure padding and alignment, this should have no practical
drawback while allowing for a lot more vars.
8 years ago
|
|
|
uint32_t idx;
|
|
|
|
|
uint8_t cmd;
|
|
|
|
|
uint8_t or_list_size;
|
|
|
|
|
uint32_t *or_list;
|
|
|
|
|
} DetectFlowbitsData;
|
|
|
|
|
|
|
|
|
|
/* prototypes */
|
|
|
|
|
void DetectFlowbitsRegister (void);
|
|
|
|
|
|
|
|
|
|
#endif /* __DETECT_FLOWBITS_H__ */
|
|
|
|
|
|
