mirror of https://github.com/OISF/suricata
Big detection engine update: scan improvements, b2g/b3g updates, bloom fixes, iponly detection implementation, dsize/flow grouping.
Victor Julien
17 years ago
parent
e877d69a2d
commit
657be002d1
@ -0,0 +1,463 @@
|
||||
/* ip only part of the detection engine */
|
||||
|
||||
/* TODO: needs a lot of work
|
||||
*
|
||||
*/
|
||||
|
||||
#include "vips.h"
|
||||
#include "debug.h"
|
||||
#include "detect.h"
|
||||
#include "flow.h"
|
||||
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
|
||||
#include "detect-engine-siggroup.h"
|
||||
#include "detect-engine-address.h"
|
||||
#include "detect-engine-proto.h"
|
||||
#include "detect-engine-port.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
|
||||
/* build a lookup tree for src, if we have one: save
|
||||
* build a lookup tree for dst, if we have one: save
|
||||
* compare tree's: if they have one (or more) matching
|
||||
* sig, we have a match. */
|
||||
|
||||
#define IPONLY_EXTRACT_16(a) ((a)->ip[0] & 0x0000ffff)
|
||||
//#define IPONLY_EXTRACT_24(a) ((a)->ip[0] & 0x00ffffff)
|
||||
|
||||
/* No need to calc a constant every lookup: htonl(65535) */
|
||||
#define IPONLY_HTONL_65535 4294901760UL
|
||||
|
||||
static u_int32_t IPOnlyHashFunc16(HashListTable *ht, void *data, u_int16_t len) {
|
||||
DetectAddressGroup *gr = (DetectAddressGroup *) data;
|
||||
|
||||
u_int32_t hash = IPONLY_EXTRACT_16(gr->ad) % ht->array_size;
|
||||
return hash;
|
||||
}
|
||||
|
||||
/*
|
||||
static u_int32_t IPOnlyHashFunc24(HashListTable *ht, void *data, u_int16_t len) {
|
||||
DetectAddressGroup *gr = (DetectAddressGroup *) data;
|
||||
|
||||
u_int32_t hash = IPONLY_EXTRACT_24(gr->ad) % ht->array_size;
|
||||
return hash;
|
||||
}
|
||||
*/
|
||||
|
||||
static void IPOnlyAddSlash16(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx, HashListTable *ht, DetectAddressGroup *gr, char direction, Signature *s) {
|
||||
u_int32_t high = ntohl(gr->ad->ip2[0]);
|
||||
u_int32_t low = ntohl(gr->ad->ip[0]);
|
||||
|
||||
if ((ntohl(gr->ad->ip2[0]) - ntohl(gr->ad->ip[0])) > 65536) {
|
||||
//printf("Bigger than a class/16:\n"); DetectAddressDataPrint(gr->ad);
|
||||
|
||||
u_int32_t s16_cnt = 0;
|
||||
|
||||
while (high > low) {
|
||||
s16_cnt++;
|
||||
|
||||
DetectAddressGroup *grtmp = DetectAddressGroupInit();
|
||||
if (grtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
DetectAddressData *adtmp = DetectAddressDataCopy(gr->ad);
|
||||
if (adtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
adtmp->ip[0] = htonl(high - 65535);
|
||||
adtmp->ip2[0] = htonl(high);
|
||||
grtmp->ad = adtmp;
|
||||
grtmp->cnt = 1;
|
||||
|
||||
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
|
||||
//printf(" -=- "); DetectAddressDataPrint(na);
|
||||
|
||||
DetectAddressGroup *rgr = HashListTableLookup(ht,grtmp,0);
|
||||
if (rgr == NULL) {
|
||||
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
|
||||
|
||||
HashListTableAdd(ht,grtmp,0);
|
||||
direction ? io_ctx->a_dst_uniq16++ : io_ctx->a_src_uniq16++;
|
||||
//printf(" uniq\n");
|
||||
} else {
|
||||
SigGroupHeadAppendSig(de_ctx, &rgr->sh, s);
|
||||
|
||||
DetectAddressGroupFree(grtmp);
|
||||
direction ? io_ctx->a_dst_total16++ : io_ctx->a_src_total16++;
|
||||
//printf(" dup\n");
|
||||
}
|
||||
|
||||
if (high >= 65536)
|
||||
high -= 65536;
|
||||
else
|
||||
high = 0;
|
||||
}
|
||||
//printf(" contains %u /16's\n", s16_cnt);
|
||||
|
||||
} else {
|
||||
DetectAddressGroup *grtmp = DetectAddressGroupInit();
|
||||
if (grtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
DetectAddressData *adtmp = DetectAddressDataCopy(gr->ad);
|
||||
if (adtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
adtmp->ip[0] = IPONLY_EXTRACT_16(gr->ad);
|
||||
adtmp->ip2[0] = IPONLY_EXTRACT_16(gr->ad) | IPONLY_HTONL_65535;
|
||||
grtmp->ad = adtmp;
|
||||
grtmp->cnt = 1;
|
||||
|
||||
//SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
|
||||
|
||||
DetectAddressGroup *rgr = HashListTableLookup(ht,grtmp,0);
|
||||
if (rgr == NULL) {
|
||||
SigGroupHeadAppendSig(de_ctx, &grtmp->sh, s);
|
||||
|
||||
HashListTableAdd(ht,grtmp,0);
|
||||
direction ? io_ctx->a_dst_uniq16++ : io_ctx->a_src_uniq16++;
|
||||
} else {
|
||||
SigGroupHeadAppendSig(de_ctx, &rgr->sh, s);
|
||||
|
||||
DetectAddressGroupFree(grtmp);
|
||||
direction ? io_ctx->a_dst_total16++ : io_ctx->a_src_total16++;
|
||||
}
|
||||
}
|
||||
error:
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
static void IPOnlyAddSlash24(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx, HashListTable *ht, DetectAddressGroup *gr, char direction, Signature *s) {
|
||||
if ((ntohl(gr->ad->ip2[0]) - ntohl(gr->ad->ip[0])) > 256) {
|
||||
//printf("Bigger than a class/24:\n"); DetectAddressDataPrint(a);
|
||||
|
||||
u_int32_t high = ntohl(gr->ad->ip2[0]);
|
||||
u_int32_t low = ntohl(gr->ad->ip[0]);
|
||||
u_int32_t s24_cnt = 0;
|
||||
|
||||
while (high > low) {
|
||||
s24_cnt++;
|
||||
|
||||
DetectAddressGroup *grtmp = DetectAddressGroupInit();
|
||||
if (grtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
DetectAddressData *adtmp = DetectAddressDataCopy(gr->ad);
|
||||
if (adtmp == NULL) {
|
||||
goto error;
|
||||
}
|
||||
adtmp->ip[0] = htonl(high - 255);
|
||||
adtmp->ip2[0] = htonl(high);
|
||||
grtmp->ad = adtmp;
|
||||
grtmp->cnt = 1;
|
||||
|
||||
//printf(" -=- "); DetectAddressDataPrint(na);
|
||||
|
||||
DetectAddressGroup *rgr = HashListTableLookup(ht,grtmp,0);
|
||||
if (rgr == NULL) {
|
||||
HashListTableAdd(ht,grtmp,0);
|
||||
direction ? io_ctx->a_dst_uniq24++ : io_ctx->a_src_uniq24++;
|
||||
//printf(" uniq\n");
|
||||
} else {
|
||||
DetectAddressGroupFree(grtmp);
|
||||
direction ? io_ctx->a_dst_total24++ : io_ctx->a_src_total24++;
|
||||
//printf(" dup\n");
|
||||
}
|
||||
|
||||
if (high >= 256)
|
||||
high -= 256;
|
||||
else
|
||||
high = 0;
|
||||
}
|
||||
//printf(" contains %u /24's\n", s24_cnt);
|
||||
|
||||
} else {
|
||||
DetectAddressGroup *rgr = HashListTableLookup(ht,gr,0);
|
||||
if (rgr == NULL) {
|
||||
HashListTableAdd(ht,gr,0);
|
||||
direction ? io_ctx->a_dst_uniq24++ : io_ctx->a_src_uniq24++;
|
||||
} else {
|
||||
direction ? io_ctx->a_dst_total24++ : io_ctx->a_src_total24++;
|
||||
}
|
||||
}
|
||||
error:
|
||||
return;
|
||||
}
|
||||
*/
|
||||
|
||||
static char IPOnlyCompareFunc(void *data1, u_int16_t len1, void *data2, u_int16_t len2) {
|
||||
DetectAddressGroup *a1 = (DetectAddressGroup *)data1;
|
||||
DetectAddressGroup *a2 = (DetectAddressGroup *)data2;
|
||||
|
||||
//printf("IPOnlyCompareFunc: "); DetectAddressDataPrint(a1->ad);
|
||||
//printf(" "); DetectAddressDataPrint(a2->ad); printf("\n");
|
||||
|
||||
if (DetectAddressCmp(a1->ad,a2->ad) != ADDRESS_EQ)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* XXX error checking */
|
||||
void IPOnlyInit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) {
|
||||
io_ctx->ht16_src = HashListTableInit(65536, IPOnlyHashFunc16, IPOnlyCompareFunc, NULL);
|
||||
io_ctx->ht16_dst = HashListTableInit(65536, IPOnlyHashFunc16, IPOnlyCompareFunc, NULL);
|
||||
/*
|
||||
io_ctx->ht24_src = HashListTableInit(65536, IPOnlyHashFunc24, IPOnlyCompareFunc, NULL);
|
||||
io_ctx->ht24_dst = HashListTableInit(65536, IPOnlyHashFunc24, IPOnlyCompareFunc, NULL);
|
||||
*/
|
||||
io_ctx->sig_init_size = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
|
||||
io_ctx->sig_init_array = malloc(io_ctx->sig_init_size);
|
||||
memset(io_ctx->sig_init_array, 0, io_ctx->sig_init_size);
|
||||
}
|
||||
|
||||
/* XXX error checking */
|
||||
void DetectEngineIPOnlyThreadInit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyThreadCtx *io_tctx) {
|
||||
DetectAddressData *sad = DetectAddressDataInit();
|
||||
sad->family = AF_INET;
|
||||
DetectAddressData *dad = DetectAddressDataInit();
|
||||
dad->family = AF_INET;
|
||||
|
||||
io_tctx->src = DetectAddressGroupInit();
|
||||
io_tctx->src->ad = sad;
|
||||
io_tctx->dst = DetectAddressGroupInit();
|
||||
io_tctx->dst->ad = dad;
|
||||
|
||||
/* initialize the signature bitarray */
|
||||
io_tctx->sig_match_size = de_ctx->io_ctx.max_idx / 8 + 1;
|
||||
io_tctx->sig_match_array = malloc(io_tctx->sig_match_size);
|
||||
memset(io_tctx->sig_match_array, 0, io_tctx->sig_match_size);
|
||||
}
|
||||
|
||||
void IPOnlyPrint(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) {
|
||||
if (!(de_ctx->flags & DE_QUIET)) {
|
||||
printf(" * IP ONLY (SRC): %u /16's in our hash, %u total address ranges in them\n",
|
||||
io_ctx->a_src_uniq16, io_ctx->a_src_uniq16 + io_ctx->a_src_total16);
|
||||
printf(" * IP ONLY (DST): %u /16's in our hash, %u total address ranges in them\n",
|
||||
io_ctx->a_dst_uniq16, io_ctx->a_dst_uniq16 + io_ctx->a_dst_total16);
|
||||
/*
|
||||
printf(" * IP ONLY (SRC): %u /24's in our hash, %u total address ranges in them\n",
|
||||
io_ctx->a_src_uniq24, io_ctx->a_src_uniq24 + io_ctx->a_src_total24);
|
||||
printf(" * IP ONLY (DST): %u /24's in our hash, %u total address ranges in them\n",
|
||||
io_ctx->a_dst_uniq24, io_ctx->a_dst_uniq24 + io_ctx->a_dst_total24);
|
||||
*/
|
||||
}
|
||||
}
|
||||
|
||||
void IPOnlyDeinit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) {
|
||||
HashListTableFree(io_ctx->ht16_src);
|
||||
io_ctx->ht16_src = NULL;
|
||||
HashListTableFree(io_ctx->ht16_dst);
|
||||
io_ctx->ht16_dst = NULL;
|
||||
/*
|
||||
HashListTableFree(io_ctx->ht24_src);
|
||||
io_ctx->ht24_src = NULL;
|
||||
HashListTableFree(io_ctx->ht24_dst);
|
||||
io_ctx->ht24_dst = NULL;
|
||||
*/
|
||||
free(io_ctx->sig_init_array);
|
||||
io_ctx->sig_init_array = NULL;
|
||||
}
|
||||
|
||||
DetectAddressGroup *IPOnlyLookupSrc16(DetectEngineCtx *de_ctx, DetectEngineIPOnlyThreadCtx *io_tctx, Packet *p) {
|
||||
io_tctx->src->ad->ip[0] = GET_IPV4_SRC_ADDR_U32(p) & 0x0000ffff;
|
||||
io_tctx->src->ad->ip2[0] = (GET_IPV4_SRC_ADDR_U32(p) & 0x0000ffff) | IPONLY_HTONL_65535;
|
||||
|
||||
//printf("IPOnlyLookupSrc16: "); DetectAddressDataPrint(io_tctx->src->ad); printf("\n");
|
||||
|
||||
DetectAddressGroup *rgr = HashListTableLookup(de_ctx->io_ctx.ht16_src, io_tctx->src, 0);
|
||||
|
||||
return rgr;
|
||||
}
|
||||
|
||||
DetectAddressGroup *IPOnlyLookupDst16(DetectEngineCtx *de_ctx, DetectEngineIPOnlyThreadCtx *io_tctx, Packet *p) {
|
||||
io_tctx->dst->ad->ip[0] = GET_IPV4_DST_ADDR_U32(p) & 0x0000ffff;
|
||||
io_tctx->dst->ad->ip2[0] = (GET_IPV4_DST_ADDR_U32(p) & 0x0000ffff) | IPONLY_HTONL_65535;
|
||||
|
||||
//printf("IPOnlyLookupDst16: "); DetectAddressDataPrint(io_tctx->dst->ad); printf("\n");
|
||||
|
||||
DetectAddressGroup *rgr = HashListTableLookup(de_ctx->io_ctx.ht16_dst, io_tctx->dst, 0);
|
||||
|
||||
return rgr;
|
||||
}
|
||||
|
||||
/* XXX handle any case: preinit a array with the any's set to 1 for both
|
||||
* src and dst, and use that if src/dst is NULL and AND that with the other
|
||||
* array. */
|
||||
void IPOnlyMatchPacket(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx,
|
||||
DetectEngineIPOnlyThreadCtx *io_tctx, Packet *p) {
|
||||
DetectAddressGroup *src = NULL, *dst = NULL;
|
||||
#if 0
|
||||
/* debug print */
|
||||
char s[16], d[16];
|
||||
inet_ntop(AF_INET, (const void *)(p->src.addr_data32), s, sizeof(s));
|
||||
inet_ntop(AF_INET, (const void *)(p->dst.addr_data32), d, sizeof(d));
|
||||
printf("IPV4 %s->%s\n",s,d);
|
||||
|
||||
printf("IPOnlyMatchPacket starting...\n");
|
||||
#endif
|
||||
if (io_tctx->src == NULL)
|
||||
return;
|
||||
|
||||
//printf("IPOnlyMatchPacket looking up src...\n");
|
||||
/* lookup source address group */
|
||||
src = IPOnlyLookupSrc16(de_ctx, io_tctx, p);
|
||||
if (src == NULL || src->sh == NULL)
|
||||
return;
|
||||
//printf("IPOnlyMatchPacket looking up dst...\n");
|
||||
|
||||
/* lookup source address group */
|
||||
dst = IPOnlyLookupDst16(de_ctx, io_tctx, p);
|
||||
if (dst == NULL || dst->sh == NULL)
|
||||
return;
|
||||
//printf("IPOnlyMatchPacket processing arrays...\n");
|
||||
|
||||
/* copy the match array from source... */
|
||||
u_int32_t u;
|
||||
for (u = 0; u < io_tctx->sig_match_size; u++) {
|
||||
io_tctx->sig_match_array[u] = src->sh->sig_array[u];
|
||||
}
|
||||
|
||||
/* ...then bitwise AND it with the dst... */
|
||||
for (u = 0; u < io_tctx->sig_match_size; u++) {
|
||||
io_tctx->sig_match_array[u] &= dst->sh->sig_array[u];
|
||||
}
|
||||
|
||||
//printf("Let's inspect the sigs\n");
|
||||
|
||||
u_int32_t sig_cnt;
|
||||
if (src->sh->sig_cnt > dst->sh->sig_cnt) sig_cnt = dst->sh->sig_cnt;
|
||||
else sig_cnt = src->sh->sig_cnt;
|
||||
|
||||
/* ...the result is that only the sigs with both
|
||||
* enable match */
|
||||
u_int32_t idx;
|
||||
for (idx = 0; idx < sig_cnt; idx++) {
|
||||
u_int32_t sig = io_ctx->match_array[idx];
|
||||
|
||||
//printf("sig internal id %u\n", sig);
|
||||
|
||||
/* sig doesn't match */
|
||||
if (!(io_tctx->sig_match_array[(sig / 8)] & (1<<(sig % 8))))
|
||||
continue;
|
||||
|
||||
Signature *s = de_ctx->sig_array[sig];
|
||||
if (s == NULL)
|
||||
continue;
|
||||
|
||||
/* check the source address */
|
||||
if (!(s->flags & SIG_FLAG_SRC_ANY)) {
|
||||
DetectAddressGroup *saddr = DetectAddressLookupGroup(&s->src,&p->src);
|
||||
if (saddr == NULL)
|
||||
continue;
|
||||
}
|
||||
/* check the destination address */
|
||||
if (!(s->flags & SIG_FLAG_DST_ANY)) {
|
||||
DetectAddressGroup *daddr = DetectAddressLookupGroup(&s->dst,&p->dst);
|
||||
if (daddr == NULL)
|
||||
continue;
|
||||
}
|
||||
|
||||
|
||||
if (!(s->flags & SIG_FLAG_NOALERT)) {
|
||||
PacketAlertAppend(p, 1, s->id, s->rev, s->prio, s->msg);
|
||||
|
||||
/* set verdict on packet */
|
||||
p->action = s->action;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int IPOnlyBuildMatchArray(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) {
|
||||
u_int32_t idx = 0;
|
||||
u_int32_t sig = 0;
|
||||
|
||||
for (sig = 0; sig < io_ctx->max_idx + 1; sig++) {
|
||||
if (!(io_ctx->sig_init_array[(sig/8)] & (1<<(sig%8))))
|
||||
continue;
|
||||
|
||||
Signature *s = de_ctx->sig_array[sig];
|
||||
if (s == NULL)
|
||||
continue;
|
||||
|
||||
io_ctx->sig_cnt++;
|
||||
}
|
||||
|
||||
io_ctx->match_array = malloc(io_ctx->sig_cnt * sizeof(u_int32_t));
|
||||
if (io_ctx->match_array == NULL)
|
||||
return -1;
|
||||
|
||||
memset(io_ctx->match_array,0, io_ctx->sig_cnt * sizeof(u_int32_t));
|
||||
|
||||
for (sig = 0; sig < io_ctx->max_idx + 1; sig++) {
|
||||
if (!(io_ctx->sig_init_array[(sig/8)] & (1<<(sig%8))))
|
||||
continue;
|
||||
|
||||
Signature *s = de_ctx->sig_array[sig];
|
||||
if (s == NULL)
|
||||
continue;
|
||||
|
||||
io_ctx->match_array[idx] = s->num;
|
||||
idx++;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void IPOnlyPrepare(DetectEngineCtx *de_ctx) {
|
||||
IPOnlyBuildMatchArray(de_ctx, &de_ctx->io_ctx);
|
||||
|
||||
/* source: set sig_cnt */
|
||||
HashListTableBucket *hb = HashListTableGetListHead(de_ctx->io_ctx.ht16_src);
|
||||
if (hb == NULL)
|
||||
return;
|
||||
|
||||
for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
|
||||
DetectAddressGroup *gr = (DetectAddressGroup *)HashListTableGetListData(hb);
|
||||
if (gr == NULL)
|
||||
continue;
|
||||
|
||||
SigGroupHeadSetSigCnt(gr->sh, de_ctx->io_ctx.max_idx);
|
||||
}
|
||||
|
||||
/* destination: set sig_cnt */
|
||||
hb = HashListTableGetListHead(de_ctx->io_ctx.ht16_dst);
|
||||
if (hb == NULL)
|
||||
return;
|
||||
|
||||
for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
|
||||
DetectAddressGroup *gr = (DetectAddressGroup *)HashListTableGetListData(hb);
|
||||
if (gr == NULL)
|
||||
continue;
|
||||
|
||||
SigGroupHeadSetSigCnt(gr->sh, de_ctx->io_ctx.max_idx);
|
||||
}
|
||||
}
|
||||
|
||||
void IPOnlyAddSignature(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx, Signature *s) {
|
||||
if (!(s->flags & SIG_FLAG_IPONLY))
|
||||
return;
|
||||
|
||||
DetectAddressGroup *src = s->src.ipv4_head;
|
||||
DetectAddressGroup *dst = s->dst.ipv4_head;
|
||||
|
||||
for ( ; src != NULL; src = src->next) {
|
||||
IPOnlyAddSlash16(de_ctx, io_ctx, io_ctx->ht16_src, src, 0, s);
|
||||
// IPOnlyAddSlash24(de_ctx, io_ctx, io_ctx->ht24_src, src, 0, s);
|
||||
}
|
||||
|
||||
for ( ; dst != NULL; dst = dst->next) {
|
||||
IPOnlyAddSlash16(de_ctx, io_ctx, io_ctx->ht16_dst, dst, 1, s);
|
||||
// IPOnlyAddSlash24(de_ctx, io_ctx, io_ctx->ht24_dst, dst, 1, s);
|
||||
}
|
||||
|
||||
if (s->num > io_ctx->max_idx)
|
||||
io_ctx->max_idx = s->num;
|
||||
|
||||
/* enable the sig in the bitarray */
|
||||
io_ctx->sig_init_array[(s->num/8)] |= 1<<(s->num%8);
|
||||
}
|
||||
|
||||
|
||||
@ -0,0 +1,13 @@
|
||||
#ifndef __DETECT_ENGINE_IPONLY_H__
|
||||
#define __DETECT_ENGINE_IPONLY_H__
|
||||
|
||||
void IPOnlyMatchPacket(DetectEngineCtx *, DetectEngineIPOnlyCtx *, DetectEngineIPOnlyThreadCtx *, Packet *);
|
||||
void IPOnlyInit(DetectEngineCtx *, DetectEngineIPOnlyCtx *);
|
||||
void IPOnlyPrint(DetectEngineCtx *, DetectEngineIPOnlyCtx *);
|
||||
void IPOnlyDeinit(DetectEngineCtx *, DetectEngineIPOnlyCtx *);
|
||||
void IPOnlyPrepare(DetectEngineCtx *);
|
||||
void DetectEngineIPOnlyThreadInit(DetectEngineCtx *, DetectEngineIPOnlyThreadCtx *);
|
||||
void IPOnlyAddSignature(DetectEngineCtx *, DetectEngineIPOnlyCtx *, Signature *);
|
||||
|
||||
#endif /* __DETECT_ENGINE_IPONLY_H__ */
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue