#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"
#include "util-classification-config.h"
#ifndef __APP_LAYER_DCERPC_COMMON_H__
#define __APP_LAYER_DCERPC_COMMON_H__
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
-#include "util-byte.h"
void RegisterDCERPCParsers(void);
void DCERPCParserTests(void);
#include "detect.h"
#include "detect-engine-port.h"
+#include "detect-engine-build.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-content.h"
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "stream.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-hashlist.h"
#include "util-print.h"
+#include "util-spm-bs.h"
+#include "util-enum.h"
#include "app-layer.h"
#include "app-layer-protos.h"
#ifndef __APP_LAYER_DNP3_H__
#define __APP_LAYER_DNP3_H__
-#include "detect-engine-state.h"
-#include "util-hashlist.h"
-#include "util-byte.h"
#include "rust.h"
/**
#ifndef __APP_LAYER_ENIP_COMMON_H__
#define __APP_LAYER_ENIP_COMMON_H__
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
+#include "rust.h"
// EtherNet/IP commands
#define NOP 0x0000
#ifndef __APP_LAYER_ENIP_H__
#define __APP_LAYER_ENIP_H__
-#include "decode.h"
-#include "detect-engine-state.h"
-#include "queue.h"
void RegisterENIPUDPParsers(void);
void RegisterENIPTCPParsers(void);
#include "stream-tcp.h"
#include "app-layer-frames.h"
+#include "app-layer-parser.h"
static void FrameDebug(const char *prefix, const Frames *frames, const Frame *frame)
{
#ifndef __APP_LAYER_FRAMES_H__
#define __APP_LAYER_FRAMES_H__
-#include "app-layer-events.h"
-#include "detect-engine-state.h"
-#include "util-file.h"
-#include "stream-tcp-private.h"
#include "rust.h"
-#include "app-layer-parser.h"
typedef int64_t FrameId;
#include "app-layer-parser.h"
#include "app-layer-ftp.h"
#include "app-layer-expectation.h"
+#include "app-layer-detect-proto.h"
#include "util-spm.h"
#include "util-mpm.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-body.h"
+#include "app-layer-htp-mem.h"
#include "util-spm.h"
#include "util-debug.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-file.h"
+#include "app-layer-htp-range.h"
#include "util-spm.h"
#include "util-debug.h"
#ifndef __APP_LAYER_HTP_LIBHTP__H__
#define __APP_LAYER_HTP_LIBHTP__H__
-#include "suricata.h"
#include "suricata-common.h"
bstr *SCHTPGenerateNormalizedUri(htp_tx_t *tx, htp_uri_t *uri, int uri_include_all);
* 02110-1301, USA.
*/
-#include "stream-tcp-reassemble.h"
void HTPParseMemcap(void);
void *HTPMalloc(size_t size);
#define __APP_LAYER_HTP_RANGE_H__
#include "suricata-common.h"
-#include "app-layer-parser.h"
#include "util-thash.h"
-#include "rust-bindings.h"
+#include "rust.h"
void HttpRangeContainersInit(void);
void HttpRangeContainersDestroy(void);
#include "app-layer-parser.h"
#include "app-layer.h"
+#include "app-layer-detect-proto.h"
#include "app-layer-frames.h"
#include "app-layer-htp.h"
#include "app-layer-htp-body.h"
#include "app-layer-htp-file.h"
#include "app-layer-htp-libhtp.h"
#include "app-layer-htp-xff.h"
+#include "app-layer-htp-range.h"
+#include "app-layer-htp-mem.h"
#include "util-spm.h"
#include "util-debug.h"
#include "util-time.h"
#include "util-misc.h"
+#include "util-enum.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "flow-util.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-state.h"
#include "detect-parse.h"
#ifndef __APP_LAYER_HTP_H__
#define __APP_LAYER_HTP_H__
-#include "util-radix-tree.h"
#include "util-file.h"
-#include "app-layer-htp-mem.h"
-#include "detect-engine-state.h"
#include "util-streaming-buffer.h"
-#include "app-layer-htp-range.h"
#include "rust.h"
+#include "app-layer-frames.h"
#include <htp/htp.h>
#include "app-layer-parser.h"
#include "app-layer-modbus.h"
+#include "detect-engine-build.h"
void ModbusParserRegisterTests(void);
#ifndef __APP_LAYER_NBSS_H__
#define __APP_LAYER_NBSS_H__
-#include "suricata-common.h"
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "stream.h"
/*
http://ubiqx.org/cifs/rfc-draft/rfc1002.html#s4.3
#include "app-layer-parser.h"
#include "app-layer-nfs-udp.h"
+#include "util-enum.h"
#include "rust.h"
#include "stream-tcp-reassemble.h"
#include "app-layer.h"
+#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-smb.h"
#define __APP_LAYER_PARSER_H__
#include "app-layer-events.h"
-#include "app-layer-frames.h"
-#include "detect-engine-state.h"
#include "util-file.h"
-#include "stream-tcp-private.h"
#include "rust.h"
#include "util-config.h"
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "stream.h"
#include "conf.h"
#include "app-layer-parser.h"
#include "app-layer-smtp.h"
+#include "util-enum.h"
#include "util-mpm.h"
#include "util-debug.h"
#include "util-print.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "detect-parse.h"
#include "decode-events.h"
#ifndef __APP_LAYER_SMTP_H__
#define __APP_LAYER_SMTP_H__
-#include "decode-events.h"
#include "util-decode-mime.h"
-#include "queue.h"
#include "util-streaming-buffer.h"
#include "rust.h"
#include "stream-tcp.h"
#include "stream.h"
+#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-ssh.h"
#include "stream.h"
#include "app-layer.h"
+#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-frames.h"
#include "util-pool.h"
#include "util-byte.h"
#include "util-ja3.h"
+#include "util-enum.h"
#include "flow-util.h"
#include "flow-private.h"
#include "util-validate.h"
#ifndef __APP_LAYER_SSL_H__
#define __APP_LAYER_SSL_H__
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "decode-events.h"
#include "util-ja3.h"
-#include "queue.h"
+#include "rust.h"
enum TlsFrameTypes {
TLS_FRAME_PDU = 0, /**< whole PDU, so header + data */
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "stream.h"
#include "conf.h"
#include "app-layer.h"
#include "util-unittest.h"
#include "util-validate.h"
+#include "util-enum.h"
/* The default port to probe for echo traffic if not provided in the
* configuration file. */
#ifndef __APP_LAYER_TEMPLATE_H__
#define __APP_LAYER_TEMPLATE_H__
-#include "detect-engine-state.h"
-#include "queue.h"
#include "rust.h"
#include "suricata-common.h"
+#include "suricata.h"
#include "stream.h"
#include "conf.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
-#include "stream.h"
-#include "util-profiling.h"
#include "rust.h"
#ifndef __DECODE_ERSPAN_H__
#define __DECODE_ERSPAN_H__
-#include "decode.h"
-#include "threadvars.h"
typedef struct ErspanHdr_ {
uint16_t ver_vlan;
#define IPPROTO_GRE 47
#endif
-#include "decode.h"
-#include "threadvars.h"
typedef struct GREHdr_
{
#ifndef __DECODE_ICMPV4_H__
#define __DECODE_ICMPV4_H__
-#include "decode.h"
#include "decode-tcp.h"
-#include "decode-sctp.h"
#include "decode-udp.h"
#define ICMPV4_HEADER_LEN 8
#define __DECODE_ICMPV6_H__
#include "decode-tcp.h"
-#include "decode-sctp.h"
#include "decode-udp.h"
#include "decode-ipv6.h"
#ifndef __DECODE_NSH_H__
#define __DECODE_NSH_H__
-#include "decode.h"
-#include "threadvars.h"
#define NSH_NEXT_PROTO_UNASSIGNED 0x0
#define NSH_NEXT_PROTO_IPV4 0x1
return TM_ECODE_OK;
}
-#ifdef UNITTESTS
-
-#endif /* UNITTESTS */
-
-/**
- * \brief Registers Null unit tests
- */
-void DecodeNullRegisterTests(void)
-{
-#ifdef UNITTESTS
-#endif /* UNITTESTS */
-}
/**
* @}
*/
#ifndef __DECODE_NULL_H__
#define __DECODE_NULL_H__
-void DecodeNullRegisterTests(void);
+
#endif /* __DECODE_NULL_H__ */
#ifndef __DECODE_PPPOE_H__
#define __DECODE_PPPOE_H__
-#include "decode.h"
-#include "threadvars.h"
// Session header length minus the protocol field
#define PPPOE_SESSION_HEADER_MIN_LEN 7
#ifndef __DECODE_TEMPLATE_H__
#define __DECODE_TEMPLATE_H__
-#include "decode.h"
-#include "threadvars.h"
/* Header layout. Keep things like alignment and endianess in
* mind while constructing this. */
#include "conf.h"
#include "decode.h"
#include "decode-teredo.h"
+#include "decode-erspan.h"
+#include "decode-geneve.h"
+#include "decode-vxlan.h"
#include "util-debug.h"
#include "util-mem.h"
#include "app-layer-detect-proto.h"
#include "threadvars.h"
#include "util-debug.h"
#include "decode-events.h"
+#ifdef PROFILING
#include "flow-worker.h"
+#include "app-layer-protos.h"
+#endif
#ifdef HAVE_NAPATECH
#include "util-napatech.h"
#include "action-globals.h"
-#include "decode-erspan.h"
#include "decode-ethernet.h"
-#include "decode-chdlc.h"
#include "decode-gre.h"
-#include "decode-geneve.h"
#include "decode-ppp.h"
#include "decode-pppoe.h"
-#include "decode-sll.h"
#include "decode-ipv4.h"
#include "decode-ipv6.h"
#include "decode-icmpv4.h"
#include "decode-udp.h"
#include "decode-sctp.h"
#include "decode-esp.h"
-#include "decode-raw.h"
-#include "decode-null.h"
#include "decode-vlan.h"
-#include "decode-vntag.h"
-#include "decode-vxlan.h"
#include "decode-mpls.h"
-#include "decode-nsh.h"
-#include "detect-reference.h"
-
-#include "app-layer-protos.h"
/* forward declarations */
struct DetectionEngineThreadCtx_;
#ifndef __DEFRAG_H__
#define __DEFRAG_H__
-#include "tree.h"
#include "util-pool.h"
/**
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "detect-app-layer-event.h"
#include "flow.h"
#include "decode-events.h"
#include "util-byte.h"
#include "util-debug.h"
+#include "util-enum.h"
+#include "util-profiling.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "stream-tcp-util.h"
#include "suricata-common.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-prefilter-common.h"
#include "detect-parse.h"
#include "detect-engine-content-inspection.h"
#include "detect-parse.h"
#include "detect-base64-data.h"
+#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-base64.h"
#include "util-byte.h"
#include "util-print.h"
+#include "detect-engine-build.h"
/* Arbitrary maximum buffer size for decoded base64 data. */
#define BASE64_DECODE_MAX 65535
#ifndef __DETECT_BASE64_DECODE_H__
#define __DETECT_BASE64_DECODE_H__
-#include "app-layer-template.h"
typedef struct DetectBase64Decode_ {
uint32_t bytes;
#include "detect-bytetest.h"
#include "detect-byte-extract.h"
#include "detect-isdataat.h"
+#include "detect-engine-build.h"
#include "app-layer-protos.h"
#include "util-debug.h"
#include "util-validate.h"
#include "detect-pcre.h"
+#include "detect-engine-build.h"
/**
* \brief Regex for parsing our options
#include "detect-byte.h"
#include "detect-bytemath.h"
#include "detect-isdataat.h"
+#include "detect-engine-build.h"
#include "app-layer-protos.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
+#include "detect-engine-build.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#ifndef _DETECT_CIPSERVICE_H
#define _DETECT_CIPSERVICE_H
-#include "app-layer-protos.h"
-#include "app-layer-parser.h"
-#include "flow.h"
-#include "queue.h"
#include "app-layer-enip-common.h"
#define ENIP_PORT 44818 //standard EtherNet/IP port
#include "detect-uricontent.h"
#include "detect-engine-mpm.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-state.h"
#include "detect-parse.h"
#include "detect-pcre.h"
#include "pkt-var.h"
#include "host.h"
#include "util-profiling.h"
+#include "detect-engine-build.h"
/* prototypes for the "ipv4-csum" rule keyword */
static int DetectIPV4CsumMatch(DetectEngineThreadCtx *,
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "detect-dce-iface.h"
#include "flow.h"
#ifndef __DETECT_DCE_IFACE_H__
#define __DETECT_DCE_IFACE_H__
-#include "app-layer-dcerpc-common.h"
void DetectDceIfaceRegister(void);
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#ifndef __DETECT_DCE_OPNUM_H__
#define __DETECT_DCE_OPNUM_H__
-#include "app-layer-dcerpc-common.h"
void DetectDceOpnumRegister(void);
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "flow-util.h"
#include "app-layer.h"
+#include "app-layer-parser.h"
#include "queue.h"
#include "stream-tcp-reassemble.h"
#ifndef __DETECT_DCE_STUB_DATA_H__
#define __DETECT_DCE_STUB_DATA_H__
-#include "app-layer-dcerpc-common.h"
void DetectDceStubDataRegister(void);
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-debug.h"
+#include "detect-engine-build.h"
#define TRACK_DST 1
#define TRACK_SRC 2
#include "detect-engine-content-inspection.h"
#include "app-layer-dnp3.h"
+#include "util-byte.h"
static int g_dnp3_match_buffer_id = 0;
static int g_dnp3_data_buffer_id = 0;
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "flow-var.h"
#include "detect-tcp-flags.h"
#include "feature.h"
#include "util-print.h"
+#include "util-time.h"
#include "util-validate.h"
static int rule_warnings_only = 0;
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
+#include "detect-content.h"
+#include "detect-engine-build.h"
#include "detect-engine-address.h"
#include "detect-engine-analyzer.h"
#include "detect-engine-iponly.h"
#include "util-profiling.h"
#include "util-validate.h"
+#include "util-var-name.h"
void SigCleanSignatures(DetectEngineCtx *de_ctx)
{
#include "detect-content.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-dcepayload.h"
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
#include "stream-tcp.h"
#ifndef __DETECT_ENGINE_EVENT_H__
#define __DETECT_ENGINE_EVENT_H__
-#include "decode-events.h"
typedef struct DetectEngineEventData_ {
uint8_t event;
#include "detect-engine-proto.h"
#include "detect-engine-port.h"
#include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
#include "detect-engine-threshold.h"
#include "detect-engine-iponly.h"
#include "util-signal.h"
#include "detect-engine-loader.h"
+#include "detect-engine-build.h"
#include "detect-engine-analyzer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-sigorder.h"
#ifndef __DETECT_ENGINE_MPM_H__
#define __DETECT_ENGINE_MPM_H__
-#include "tm-threads.h"
#include "detect.h"
-#include "detect-content.h"
-#include "detect-uricontent.h"
-#include "stream.h"
void DetectMpmInitializeFrameMpms(DetectEngineCtx *de_ctx);
int DetectMpmPrepareFrameMpms(DetectEngineCtx *de_ctx);
#include "detect-engine-prefilter.h"
#include "detect-engine-state.h"
#include "detect-engine-payload.h"
+#include "detect-engine-build.h"
#include "stream.h"
#include "stream-tcp.h"
#include "detect-http-ua.h"
#include "detect-http-host.h"
+#include "detect-mark.h"
#include "detect-nfs-procedure.h"
#include "detect-nfs-version.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "detect-engine-address.h"
#include "detect-engine-mpm.h"
#include "detect-engine-siggroup.h"
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
#include "detect-pcre.h"
+#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-engine-dcepayload.h"
+#include "detect-engine-build.h"
#include "detect-flowvar.h"
#include "util-time.h"
#include "util-hashlist.h"
#include "detect-engine-tag.h"
+#include "detect-engine-build.h"
#include "detect-tag.h"
#include "host.h"
#include "host-storage.h"
#include "host.h"
#include "detect.h"
+#include "detect-tag.h"
/* This limit should be overwriten/predefined at the config file
* to limit the options to prevent possible DOS situations. We should also
#include "detect-parse.h"
#include "detect-engine-sigorder.h"
+#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-port.h"
#include "detect-engine-mpm.h"
#include "detect-engine-iponly.h"
#include "detect-engine-tag.h"
+#include "detect-engine-frame.h"
#include "detect-engine-file.h"
#include "util-profiling.h"
#include "util-validate.h"
#include "util-hash-string.h"
+#include "util-enum.h"
#include "tm-threads.h"
#include "runmodes.h"
#define __DETECT_ENGINE_H__
#include "detect.h"
-#include "tm-threads.h"
-#include "flow-private.h"
-
-#include "detect-engine-frame.h"
+#include "suricata.h"
void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size);
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
#include "detect-fast-pattern.h"
#include "util-error.h"
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#ifndef __DETECT_FILEEXT_H__
#define __DETECT_FILEEXT_H__
-#include "util-spm-bm.h"
typedef struct DetectFileextData_ {
uint8_t *ext; /** file extension to match */
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-engine-uint.h"
+#include "detect-engine-build.h"
#include "detect-filesize.h"
#include "util-debug.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "util-var-name.h"
#include "util-unittest.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-sigorder.h"
+#include "detect-engine-build.h"
#include "pkt-var.h"
#include "host.h"
#include "util-var-name.h"
#include "util-debug.h"
#include "util-print.h"
+#include "util-spm.h"
#define PARSE_REGEX "(.*),(.*)"
static DetectParseRegex parse_regex;
#ifndef __DETECT_FRAGBITS_H__
#define __DETECT_FRAGBITS_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
/**
* \struct DetectFragBitsData_
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-fragoffset.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-content.h"
+#include "detect-engine-build.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#ifndef __DETECT_FTPDATA_H__
#define __DETECT_FTPDATA_H__
-#include "detect-engine.h"
#include "app-layer-ftp.h"
/** Per keyword data. This is set up by the DetectFtpcommandSetup() function.
#ifdef HAVE_GEOIP
#include <maxminddb.h>
-#include "util-spm-bm.h"
#define GEOOPTION_MAXSIZE 3 /* Country Code (2 chars) + NULL */
#define GEOOPTION_MAXLOCATIONS 64
#ifndef __DETECT_GID_H__
#define __DETECT_GID_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
/**
* Registration function for gid: keyword
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow-bit.h"
#include "host-bit.h"
*/
#include "suricata-common.h"
-#include "threads.h"
-#include "decode.h"
#include "flow.h"
-#include "app-layer.h"
-#include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "app-layer-htp.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-#include "detect-content.h"
-#include "detect-http-header.h"
#include "util-debug.h"
+#include "rust.h"
static int g_buffer_id = 0;
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
+
#include "detect-engine.h"
#include "detect-engine-uint.h"
#include "detect-engine-mpm.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-icmp-id.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-icmp-seq.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
#include "detect-engine-uint.h"
+#include "detect-engine-build.h"
#include "detect-icode.h"
#ifndef __DETECT_IPOPTS_H__
#define __DETECT_IPOPTS_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
/**
* \struct DetectIpOptsData_
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-uint.h"
+#include "detect-engine-build.h"
#include "util-debug.h"
#include "util-byte.h"
#include "detect-isdataat.h"
#include "detect-content.h"
#include "detect-uricontent.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-itype.h"
#include "detect-engine-uint.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
UtRegisterTest("DetectL3protoTestSig2", DetectL3protoTestSig2);
UtRegisterTest("DetectL3protoTestSig3", DetectL3protoTestSig3);
}
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#ifndef __DETECT_MARK_H__
#define __DETECT_MARK_H__
-#include "decode.h"
-#include "detect.h"
/**
* \struct DetectMarkData_
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine-port.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "detect-flowvar.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-sigorder.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "util-var-name.h"
#include "util-unittest-helper.h"
#include "detect-content.h"
#include "util-spm.h"
#include "util-debug.h"
+#include "util-var-name.h"
#define PARSE_REGEX "(.*),(.*)"
static DetectParseRegex parse_regex;
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
+
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-quic-cyu-hash.h"
+#include "detect-engine-build.h"
#include "rust.h"
#ifdef UNITTESTS
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-quic-cyu-string.h"
+#include "detect-engine-build.h"
#include "rust.h"
#ifdef UNITTESTS
#ifndef __DETECT_REFERENCE_H__
#define __DETECT_REFERENCE_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
/**
* \brief Signature reference list.
#include "detect-engine-mpm.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "util-checksum.h"
UtRegisterTest("DetectReplaceParseTest06", DetectReplaceParseTest06);
UtRegisterTest("DetectReplaceParseTest07", DetectReplaceParseTest07);
}
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
#ifndef __DETECT_REPLACE_H__
#define __DETECT_REPLACE_H__
+#include "detect-content.h"
+
DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd);
/* Internal functions are only called via the inline functions below. */
#include "detect-engine-mpm.h"
#include "detect-engine-siggroup.h"
#include "detect-engine-address.h"
+#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
+#include "detect-engine-build.h"
#include "detect-sameip.h"
{
UtRegisterTest("DetectSameipSigTest01", DetectSameipSigTest01);
}
-#endif /* UNITTESTS */
\ No newline at end of file
+#endif /* UNITTESTS */
#ifndef __DETECT_SNMP_COMMUNITY_H__
#define __DETECT_SNMP_COMMUNITY_H__
-#include "app-layer-snmp.h"
void DetectSNMPCommunityRegister(void);
#ifndef __DETECT_SNMP_PDU_TYPE_H__
#define __DETECT_SNMP_PDU_TYPE_H__
-#include "app-layer-snmp.h"
void DetectSNMPPduTypeRegister(void);
#ifndef __DETECT_SNMP_VERSION_H__
#define __DETECT_SNMP_VERSION_H__
-#include "app-layer-snmp.h"
void DetectSNMPVersionRegister(void);
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow.h"
#include "flow-var.h"
#ifndef DETECT_SSL_STATE_H
#define DETECT_SSL_STATE_H
-#include "app-layer-ssl.h"
/* we pick these flags flags from the parser */
#define DETECT_SSL_STATE_CLIENT_HELLO SSL_AL_FLAG_STATE_CLIENT_HELLO
#define __DETECT_TAG_H__
#include "suricata-common.h"
-#include "suricata.h"
-#include "util-time.h"
/* Limit the number of times a session can be tagged by the
* same rule without finishing older tags */
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-tcp-ack.h"
#ifndef __DETECT_FLAGS_H__
#define __DETECT_FLAGS_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
/**
* \struct DetectFlagsData_
#include "detect-engine.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-prefilter-common.h"
+#include "detect-engine-build.h"
#include "detect-tcp-seq.h"
#ifndef __DETECT_TEMPLATE_BUFFER_H__
#define __DETECT_TEMPLATE_BUFFER_H__
-#include "app-layer-template.h"
void DetectTemplateBufferRegister(void);
#include "detect-engine-content-inspection.h"
#include "detect-template-rust-buffer.h"
#include "app-layer-parser.h"
+#include "detect-engine-build.h"
#include "rust.h"
#ifndef __DETECT_TEMPLATE_RUST_BUFFER_H__
#define __DETECT_TEMPLATE_RUST_BUFFER_H__
-#include "app-layer-template.h"
void DetectTemplateRustBufferRegister(void);
#include "detect-threshold.h"
#include "detect-engine-threshold.h"
#include "detect-engine-address.h"
+#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#ifndef __DETECT_THRESHOLD_H__
#define __DETECT_THRESHOLD_H__
-#include "decode-events.h"
-#include "decode-ipv4.h"
-#include "decode-tcp.h"
#define TYPE_LIMIT 1
#define TYPE_BOTH 2
#ifndef __DETECT_TLS_ISSUER_H__
#define __DETECT_TLS_ISSUER_H__
-#include "app-layer-ssl.h"
void DetectTlsIssuerRegister(void);
#ifndef __DETECT_TLS_SUBJECT_H__
#define __DETECT_TLS_SUBJECT_H__
-#include "app-layer-ssl.h"
void DetectTlsSubjectRegister(void);
#include "detect.h"
#include "detect-parse.h"
+#include "detect-content.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-parse.h"
#include "detect-transform-dotprefix.h"
+#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-print.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-prefilter.h"
+#include "detect-engine-build.h"
#include "detect-parse.h"
#include "detect-transform-strip-whitespace.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-prefilter.h"
+#include "detect-engine-build.h"
#include "detect-parse.h"
#include "detect-transform-urldecode.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "detect-content.h"
#include "detect-engine-uint.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
+#include "detect-engine-build.h"
#include "flow-bit.h"
#include "host-bit.h"
#include "stream-tcp.h"
#include "app-layer.h"
#include "app-layer-parser.h"
+#include "app-layer-frames.h"
#include "detect.h"
#include "detect-dsize.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
+#include "detect-engine-frame.h"
#include "detect-engine-profile.h"
#include "detect-engine-alert.h"
#include "util-validate.h"
#include "util-detect.h"
+#include "util-profiling.h"
typedef struct DetectRunScratchpad {
const AppProto alproto;
#include "detect-reference.h"
#include "detect-metadata.h"
#include "detect-engine-register.h"
-#include "packet-queue.h"
#include "util-prefilter.h"
#include "util-mpm.h"
#include "util-spm.h"
#include "util-hash.h"
#include "util-hashlist.h"
-#include "util-debug.h"
-#include "util-error.h"
#include "util-radix-tree.h"
#include "util-file.h"
#include "reputation.h"
-#include "detect-mark.h"
-
-#include "stream.h"
-
-#include "util-var-name.h"
-
#include "app-layer-events.h"
#define DETECT_MAX_RULE_SIZE 8192
void DumpPatterns(DetectEngineCtx *de_ctx);
-#include "detect-engine-build.h"
-#include "detect-engine-register.h"
#endif /* __DETECT_H__ */
#ifndef __DEVICE_STORAGE_H__
#define __DEVICE_STORAGE_H__
-#include "util-storage.h"
#include "util-device.h"
typedef struct LiveDevStorageId_ {
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "feature.h"
#include "util-hash.h"
#include "flow-bypass.h"
#include "flow-private.h"
#include "util-ebpf.h"
+#include "runmodes.h"
#ifdef CAPTURE_OFFLOAD_MANAGER
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
+#include "util-device.h"
#include "util-debug.h"
#include "util-privs.h"
#ifndef __FLOW_STORAGE_H__
#define __FLOW_STORAGE_H__
-#include "util-storage.h"
#include "flow.h"
typedef struct FlowStorageId {
#include "util-var.h"
#include "util-debug.h"
+#include "util-macset.h"
#include "flow-storage.h"
#include "detect.h"
#ifndef __FLOW_UTIL_H__
#define __FLOW_UTIL_H__
-#include "detect-engine-state.h"
-#include "tmqh-flow.h"
#include "stream-tcp-private.h"
#define COPY_TIMESTAMP(src,dst) ((dst)->tv_sec = (src)->tv_sec, (dst)->tv_usec = (src)->tv_usec)
#include "detect-engine.h"
#include "output.h"
#include "app-layer-parser.h"
+#include "app-layer-frames.h"
+#include "util-profiling.h"
#include "util-validate.h"
+#include "util-time.h"
+#include "tmqh-packetpool.h"
#include "flow-util.h"
#include "flow-manager.h"
#include "flow-timeout.h"
#include "flow-spare-pool.h"
+#include "flow-worker.h"
typedef DetectEngineThreadCtx *DetectEngineThreadCtxPtr;
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-misc.h"
+#include "util-macset.h"
#include "util-debug.h"
#include "util-privs.h"
#include "decode.h"
#include "util-exception-policy.h"
#include "util-var.h"
-#include "util-atomic.h"
-#include "util-device.h"
-#include "detect-tag.h"
-#include "util-macset.h"
#include "util-optimize.h"
+#include "app-layer-protos.h"
/* Part of the flow structure, so we declare it here.
* The actual declaration is in app-layer-parser.c */
#ifndef __HOST_STORAGE_H__
#define __HOST_STORAGE_H__
-#include "util-storage.h"
#include "host.h"
typedef struct HostStorageId_ {
#define __IPPAIR_BIT_H__
#include "ippair.h"
-#include "util-var.h"
void IPPairBitInitCtx(void);
void IPPairBitRegisterTests(void);
#ifndef __IPPAIR_STORAGE_H__
#define __IPPAIR_STORAGE_H__
-#include "util-storage.h"
#include "ippair.h"
typedef struct IPPairStorageId {
#include "log-cf-common.h"
#include "util-print.h"
#include "util-unittest.h"
+#include "util-time.h"
/**
* \brief Creates a custom format node
#include "util-fmemopen.h"
#include "util-datalink.h"
#include "stream-tcp-util.h"
+#include "stream.h"
#ifdef HAVE_LIBLZ4
#include <lz4frame.h>
#ifndef __OUTPUT_FLOW_H__
#define __OUTPUT_FLOW_H__
-#include "decode.h"
/** flow logger function pointer type */
typedef int (*FlowLogger)(ThreadVars *, void *thread_data, Flow *f);
#include "flow.h"
#include "conf.h"
+#include "stream.h"
#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-logopenfile.h"
#include "util-misc.h"
+#include "util-time.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect.h"
#include "pkt-var.h"
#include "conf.h"
+#include "suricata.h"
#include "threads.h"
#include "threadvars.h"
#include "output.h"
#include "util-privs.h"
#include "util-buffer.h"
+#include "util-device.h"
#include "util-proto-name.h"
#include "util-logopenfile.h"
#include "util-time.h"
#ifndef __OUTPUT_JSON_FRAME_H__
#define __OUTPUT_JSON_FRAME_H__
+#include "app-layer-frames.h"
+#include "stream-tcp-private.h"
+
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f,
const TcpStream *stream, const Packet *p, JsonBuilder *jb);
void JsonFrameLogRegister(void);
#include "output.h"
#include "util-privs.h"
#include "util-buffer.h"
+#include "util-device.h"
#include "util-proto-name.h"
#include "util-logopenfile.h"
#include "util-time.h"
#include "tm-threads.h"
#include "util-print.h"
+#include "util-time.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "tm-threads.h"
#include "util-print.h"
+#include "util-time.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"
+#include "util-time.h"
+#include "util-var-name.h"
+#include "util-macset.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "app-layer-parser.h"
#include "util-classification-config.h"
#include "util-syslog.h"
+#include "output-eve-syslog.h"
#include "output.h"
#include "output-json.h"
#define __OUTPUT_PACKET_H__
#include "decode.h"
-#include "output.h"
+#include "tm-modules.h"
/** packet logger function pointer type */
typedef int (*PacketLogger)(ThreadVars *, void *thread_data, const Packet *);
#ifndef __OUTPUT_STREAMING_H__
#define __OUTPUT_STREAMING_H__
-#include "decode.h"
-#include "util-file.h"
#define OUTPUT_STREAMING_FLAG_OPEN 0x01
#define OUTPUT_STREAMING_FLAG_CLOSE 0x02
#ifndef __OUTPUT_H__
#define __OUTPUT_H__
-#include "suricata.h"
-#include "tm-threads.h"
-
#define DEFAULT_LOG_MODE_APPEND "yes"
#define DEFAULT_LOG_FILETYPE "regular"
#include "output-streaming.h"
#include "output-stats.h"
-#include "util-config.h"
typedef struct OutputLoggerThreadStore_ {
void *thread_data;
SCCondT cond_q;
} PacketQueue;
-#include "decode.h"
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, struct Packet_ *p);
void PacketEnqueue (PacketQueue *, struct Packet_ *);
* from queue.h instead the Suricata copy.
*/
-#include "autoconf.h"
#if defined(HAVE_SYS_QUEUE_H) && !defined(__clang_analyzer__)
#include <sys/queue.h>
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "decode.h"
#include "decode-ipv4.h"
#ifndef __RESPOND_REJECT_H__
#define __RESPOND_REJECT_H__
-#include "tm-threads.h"
enum RejectDirection {
REJECT_DIR_SRC = 0,
#include "util-dpdk-i40e.h"
#include "util-dpdk-ice.h"
#include "util-dpdk-ixgbe.h"
+#include "util-time.h"
#ifdef HAVE_DPDK
#define __RUNMODE_NAPATECH_H__
#ifdef HAVE_NAPATECH
-#include "util-napatech.h"
#include <nt.h>
#endif /* HAVE_NAPATECH */
#include "util-streaming-buffer.h"
#include "util-lua.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
+#include "decode-chdlc.h"
+#include "decode-geneve.h"
+#include "decode-nsh.h"
+#include "decode-raw.h"
+#include "decode-vntag.h"
+#include "decode-vxlan.h"
#ifdef OS_WIN32
#include "win32-syscall.h"
#include "util-time.h"
#include "util-cpu.h"
#include "util-affinity.h"
+#include "util-var-name.h"
#include "unix-manager.h"
#include "detect-engine.h"
#include "conf-yaml-loader.h"
#include "datasets.h"
+#include "runmode-unix-socket.h"
int unix_socket_mode_is_running = 0;
#include "conf.h"
#include "queue.h"
#include "runmodes.h"
+#include "runmode-af-packet.h"
+#include "runmode-dpdk.h"
+#include "runmode-erf-dag.h"
+#include "runmode-erf-file.h"
+#include "runmode-ipfw.h"
+#include "runmode-napatech.h"
+#include "runmode-netmap.h"
+#include "runmode-nflog.h"
+#include "runmode-nfq.h"
+#include "runmode-pcap.h"
+#include "runmode-pcap-file.h"
+#include "runmode-pfring.h"
+#include "runmode-unix-socket.h"
+#include "runmode-windivert.h"
#include "util-unittest.h"
#include "util-misc.h"
#include "util-plugin.h"
void RunModeEnablesBypassManager(void);
int RunModeNeedsBypassManager(void);
-#include "runmode-pcap.h"
-#include "runmode-pcap-file.h"
-#include "runmode-pfring.h"
-#include "runmode-nfq.h"
-#include "runmode-ipfw.h"
-#include "runmode-erf-file.h"
-#include "runmode-erf-dag.h"
-#include "runmode-napatech.h"
-#include "runmode-af-packet.h"
-#include "runmode-nflog.h"
-#include "runmode-unix-socket.h"
-#include "runmode-netmap.h"
-#include "runmode-windivert.h"
-#include "runmode-dpdk.h"
extern int threading_set_cpu_affinity;
extern float threading_detect_ratio;
#include "util-lua.h"
// hack for include orders cf SCSha256
typedef struct HttpRangeContainerBlock HttpRangeContainerBlock;
+#include "detect-engine-state.h"
#include "rust-context.h"
#include "rust-bindings.h"
#ifndef __SOURCE_DPDK_H__
#define __SOURCE_DPDK_H__
-#include "queue.h"
-#include "util-dpdk.h"
+#ifdef HAVE_DPDK
+#include <rte_ethdev.h>
+#endif
typedef enum { DPDK_COPY_MODE_NONE, DPDK_COPY_MODE_TAP, DPDK_COPY_MODE_IPS } DpdkCopyModeEnum;
#include "source-pcap-file-directory-helper.h"
#include "runmode-unix-socket.h"
#include "util-mem.h"
+#include "util-time.h"
#include "source-pcap-file.h"
+#include "suricata.h"
static void GetTime(struct timespec *tm);
static void CopyTime(struct timespec *from, struct timespec *to);
#include "util-profiling.h"
#include "source-pcap-file.h"
#include "util-exception-policy.h"
+#include "suricata.h"
extern int max_pending_packets;
extern PcapFileGlobalVars pcap_g;
#include "source-pcap-file-directory-helper.h"
#include "flow-manager.h"
#include "util-checksum.h"
+#include "runmode-unix-socket.h"
+#include "suricata.h"
extern int max_pending_packets;
PcapFileGlobalVars pcap_g;
#include "util-optimize.h"
#include "util-checksum.h"
#include "util-ioctl.h"
+#include "util-time.h"
#include "tmqh-packetpool.h"
#define PCAP_STATE_DOWN 0
#ifndef __STREAM_TCP_LIST_H__
#define __STREAM_TCP_LIST_H__
-#include "stream-tcp-private.h"
#ifdef UNITTESTS
void StreamTcpListRegisterTests(void);
#ifndef __STREAM_TCP_PRIVATE_H__
#define __STREAM_TCP_PRIVATE_H__
-#include "tree.h"
-#include "decode.h"
-#include "util-pool.h"
#include "util-pool-thread.h"
#include "util-streaming-buffer.h"
#define __STREAM_TCP_REASSEMBLE_H__
#include "stream-tcp-private.h"
-#include "stream.h"
-#include "app-layer-detect-proto.h"
#include "stream-tcp-private.h"
+#ifdef UNITTESTS
+#include "suricata.h"
+#endif
+
/** Supported OS list and default OS policy is BSD */
enum
{
#include "util-runmodes.h"
#include "util-random.h"
#include "util-exception-policy.h"
+#include "util-time.h"
#include "source-pcap-file.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
+#include "suricata.h"
#define STREAM_VERBOSE false
/* Flag to indicate that the checksum validation for the stream engine
#ifndef __STREAM_H__
#define __STREAM_H__
-#include "flow.h"
#include "stream-tcp-private.h"
#define STREAM_FLAGS_FOR_PACKET(p) PKT_IS_TOSERVER((p)) ? STREAM_TOSERVER : STREAM_TOCLIENT
#include "util-ioctl.h"
#include "util-device.h"
#include "util-misc.h"
+#include "util-macset.h"
#include "util-running-modes.h"
#include "detect-engine.h"
#include "runmodes.h"
#include "runmode-unittests.h"
+#include "runmode-af-packet.h"
#include "util-debug.h"
#include "util-error.h"
#include "util-daemon.h"
#include "util-byte.h"
+#include "util-luajit.h"
#include "reputation.h"
#include "output.h"
#define __SURICATA_H__
#include "suricata-common.h"
-#include "packet-queue.h"
/* the name of our binary */
#define PROG_NAME "Suricata"
#include "../decode.h"
#include "../flow.h"
#include "../detect.h"
+#include "detect-engine-build.h"
#define TEST_HEADER \
ThreadVars tv; \
#include "detect-engine-prefilter.h"
#include "detect-isdataat.h"
#include "stream-tcp-reassemble.h"
-
+#include "detect-engine-build.h"
#include "flow-util.h"
#include "util-debug.h"
#include "../app-layer-htp.h"
#include "../app-layer-protos.h"
#include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
/***********************************Unittests**********************************/
#include "../app-layer-htp.h"
#include "../detect-http-header.h"
#include "../detect-http-header-common.h"
+#include "../detect-engine-build.h"
#include "../detect-isdataat.h"
#include "app-layer.h"
#include "app-layer-htp.h"
#include "app-layer-protos.h"
+#include "detect-engine-build.h"
/**
* \test Test that the http_host content matches against a http request
#include "../app-layer-htp.h"
#include "../app-layer-protos.h"
#include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
/**
* \test Test that the http_method content matches against a http request
#include "../detect-engine.h"
#include "../detect-isdataat.h"
#include "../detect-pcre.h"
+#include "../detect-engine-build.h"
#include "../stream-tcp.h"
#include "../app-layer.h"
#include "../decode.h"
#include "../flow.h"
#include "../detect.h"
+#include "../detect-engine-build.h"
/**
* \test Test parser accepting valid rules and rejecting invalid rules
#include "../app-layer.h"
#include "../app-layer-htp.h"
#include "../app-layer-protos.h"
+#include "../detect-engine-build.h"
static int DetectEngineHttpStatCodeTest01(void)
{
#include "../app-layer.h"
#include "../app-layer-htp.h"
#include "../app-layer-protos.h"
+#include "../detect-engine-build.h"
static int DetectEngineHttpStatMsgTest01(void)
{
#include "../flow-util.h"
#include "../detect-isdataat.h"
+#include "../detect-engine-build.h"
/** \test Test a simple uricontent option */
static int UriTestSig01(void)
#include "app-layer.h"
#include "app-layer-htp.h"
#include "app-layer-protos.h"
+#include "detect-engine-build.h"
static int DetectEngineHttpUATest(
const uint8_t *buf, const uint32_t buf_len, const char *sig, const bool expect)
#include "detect-parse.h"
#include "flow-util.h"
#include "stream-tcp.h"
+#include "detect-engine-build.h"
static int DetectSNMPCommunityTest(void)
{
*
*/
+#include "detect-engine-build.h"
+
static int DetectSslStateTest01(void)
{
DetectSslStateData *ssd = DetectSslStateParse("client_hello");
*
*/
+#include "detect-engine-build.h"
+
/**
* \test DetectSslVersionTestParse01 is a test to make sure that we parse the
* "ssl_version" option correctly when given valid ssl_version option
#include "../detect-parse.h"
#include "../flow-util.h"
#include "../stream-tcp.h"
+#include "../detect-engine-build.h"
static int DetectTemplateBufferTest(void)
{
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
/**
* \test Test that a signature containing tls_cert_fingerprint is correctly parsed
* and that the keyword is registered.
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test that a signature containing a tls_cert_issuer is correctly parsed
* and that the keyword is registered.
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test that a signature containing tls.cert_serial is correctly parsed
* and that the keyword is registered.
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test that a signature containing a tls.cert_subject is correctly parsed
* and that the keyword is registered.
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test This is a test for a valid value 1430000000.
*
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test that a signature containing tls.certs is correctly parsed
* and that the keyword is registred.
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test matching on a simple client hello packet
*/
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test matching on a simple client hello packet
*/
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test matching on a JA3S hash from a ServerHello record
*/
* 02110-1301, USA.
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test matching on a simple client hello packet
*/
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test Test matching on a simple google.com SNI
*/
*
*/
+#include "detect-engine-build.h"
+#include "app-layer-parser.h"
+
/**
* \test DetectTlsVersionTestParse01 is a test to make sure that we parse the "id"
* option correctly when given valid id option
#include "../detect-engine.h"
#include "../util-unittest.h"
+#include "../detect-engine-build.h"
/**
* \test DetectTtlParseTest01 is a test for setting up an valid ttl value.
#include "../conf-yaml-loader.h"
#include "../detect-parse.h"
#include "../detect-engine-content-inspection.h"
+#include "../detect-engine-build.h"
#include "../pkt-var.h"
#include "../flow-util.h"
#include "../stream-tcp-reassemble.h"
#include "../util-unittest.h"
+#include "../util-var-name.h"
#include "../util-unittest-helper.h"
static const char *dummy_conf_string =
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "app-layer-detect-proto.h"
#include "flow-util.h"
#include "app-layer-parser.h"
#include "suricata-common.h"
+#include "suricata.h"
#include "app-layer-detect-proto.h"
#include "flow-util.h"
#include "app-layer-parser.h"
#include "suricata-common.h"
+#include "suricata.h"
#include "conf-yaml-loader.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "app-layer-detect-proto.h"
#include "defrag.h"
#include "tm-modules.h"
#include "source-pcap-file.h"
#include "util-unittest-helper.h"
#include "conf-yaml-loader.h"
+#include "util-time.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
#include "suricata-common.h"
+#include "suricata.h"
#include "util-decode-mime.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
#include "app-layer.h"
#include "tm-queuehandlers.h"
#include "util-cidr.h"
+#include "util-profiling.h"
#include "util-proto-name.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "conf-yaml-loader.h"
#include "pkt-var.h"
#include "flow-util.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
#include <fuzz_pcap.h>
#include "app-layer.h"
#include "tm-queuehandlers.h"
#include "util-cidr.h"
+#include "util-profiling.h"
#include "util-proto-name.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "conf-yaml-loader.h"
#include "pkt-var.h"
#include "flow-util.h"
+#include "flow-worker.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
#include "app-layer.h"
#include "tm-queuehandlers.h"
#include "util-cidr.h"
+#include "util-profiling.h"
#include "util-proto-name.h"
#include "detect-engine-tag.h"
#include "detect-engine-threshold.h"
#include "conf-yaml-loader.h"
#include "pkt-var.h"
#include "flow-util.h"
+#include "flow-worker.h"
+#include "tm-modules.h"
+#include "tmqh-packetpool.h"
#include <fuzz_pcap.h>
#ifndef __THREADVARS_H__
#define __THREADVARS_H__
-#include "util-affinity.h"
#include "tm-queues.h"
#include "counters.h"
-#include "threads.h"
#include "packet-queue.h"
#include "util-atomic.h"
#include "tm-threads.h"
#include "tmqh-packetpool.h"
#include "threads.h"
+#include "util-affinity.h"
#include "util-debug.h"
#include "util-privs.h"
#include "util-cpu.h"
#include "decode.h"
#include "threads.h"
-#include "util-atomic.h"
/* Return stack, onto which other threads free packets. */
typedef struct PktPoolLockedStack_{
#include "tm-threads.h"
#include "runmodes.h"
#include "conf.h"
+#include "runmode-unix-socket.h"
#include "output-json-stats.h"
#define __UTIL_BASE64_H_
#include "suricata-common.h"
-#include "threads.h"
-#include "debug.h"
-#include "decode.h"
-#include "detect.h"
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "flow.h"
-#include "flow-var.h"
-#include "flow-util.h"
-#include "util-debug.h"
-#include "util-spm-bm.h"
/* Constants */
#define ASCII_BLOCK 3
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "conf.h"
#include "runmodes.h"
#include "util-conf.h"
*/
#include "suricata-common.h"
+#include "util-debug-filters.h"
/* both of these are defined in util-debug.c */
extern int sc_log_module_initialized;
#define __DEBUG_FILTERS_H__
#include <pthread.h>
-#include "threads.h"
-#include "util-mem.h"
/**
* \brief Enum that holds the different kinds of filters available
#include "util-error.h"
#include "util-enum.h"
#include "util-debug-filters.h"
+#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "util-unittest.h"
#include "util-syslog.h"
+#include "util-time.h"
#include "rust.h"
#include "suricata-common.h"
#include "threads.h"
-#include "util-enum.h"
#include "util-error.h"
#include "util-debug-filters.h"
-#include "util-atomic.h"
/**
* \brief ENV vars that can be used to set the properties for the logging module
#include <stdlib.h>
#include <stdint.h>
-#include "suricata.h"
#include "util-base64.h"
-#include "util-debug.h"
/* Content Flags */
#define CTNT_IS_MSG 1
#define __UTIL_DEVICE_H__
#include "queue.h"
-#include "unix-manager.h"
#define OFFLOAD_FLAG_SG (1<<0)
#define OFFLOAD_FLAG_TSO (1<<1)
#define UTIL_DPDK_I40E_H
#include "suricata-common.h"
-#include "util-dpdk.h"
#ifdef HAVE_DPDK
#define UTIL_DPDK_ICE_H
#include "suricata-common.h"
-#include "util-dpdk.h"
#ifdef HAVE_DPDK
#define UTIL_DPDK_IXGBE_H
#include "suricata-common.h"
-#include "util-dpdk.h"
#ifdef HAVE_DPDK
#include <sys/resource.h>
#include "util-ebpf.h"
+#include "util-affinity.h"
#include "util-cpu.h"
#include "util-device.h"
#ifndef __UTIL_EBPF_H__
#define __UTIL_EBPF_H__
+#include "flow-bypass.h"
+
#ifdef HAVE_PACKET_EBPF
#define XDP_FLAGS_UPDATE_IF_NOEXIST (1U << 0)
#define XDP_FLAGS_DRV_MODE (1U << 2)
#define XDP_FLAGS_HW_MODE (1U << 3)
-#include "flow-bypass.h"
struct flowv4_keys {
__be32 src;
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "util-exception-policy.h"
#include "util-misc.h"
#include "suricata-common.h"
#include "conf.h"
#include "util-device.h"
+#include "decode-sll.h"
#ifdef HAVE_SYS_IOCTL_H
#include <sys/ioctl.h>
#include "util-device.h"
#ifdef OS_WIN32
-#include "win32-syscall.h"
#endif
int GetIfaceMTU(const char *pcap_dev);
#include "output.h" /* DEFAULT_LOG_* */
#include "util-byte.h"
#include "util-logopenfile.h"
+#include "util-time.h"
+#include "suricata.h"
#if defined(HAVE_SYS_UN_H) && defined(HAVE_SYS_SOCKET_H) && defined(HAVE_SYS_TYPES_H)
#define BUILD_WITH_UNIXSOCKET
#include "util-print.h"
#include "util-unittest.h"
+#include "util-luajit.h"
#include "util-debug.h"
#include <lualib.h>
#include <lauxlib.h>
-#include "util-luajit.h"
typedef struct LuaStreamingBuffer_ {
const uint8_t *data;
#include "conf.h"
#include "util-pool.h"
#include "util-lua.h"
+#include "util-luajit.h"
/** \brief lua_State pool
*
#ifdef HAVE_LUAJIT
+#include "util-lua.h"
+
int LuajitSetupStatesPool(void);
void LuajitFreeStatesPool(void);
lua_State *LuajitGetState(void);
#define __UTIL_MEMCMP_H__
#include "util-optimize.h"
+#include "suricata.h"
/** \brief compare two patterns, converting the 2nd to lowercase
* \warning *ONLY* the 2nd pattern is converted to lowercase
#ifndef __UTIL_MISC_H__
#define __UTIL_MISC_H__
-#include "util-error.h"
/**
* \brief Generic API that can be used by all to log an
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "util-mpm-ac-bs.h"
#include "conf.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "conf.h"
#include "util-debug.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "conf.h"
#include "util-debug.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-build.h"
#include "conf.h"
#include "util-debug.h"
#include "suricata-common.h"
#include "suricata-plugin.h"
+#include "suricata.h"
+#include "runmodes.h"
#include "output-eve-syslog.h"
#include "util-plugin.h"
#define __UTIL_PLUGIN_H__
#include "suricata-plugin.h"
-#include "output-eve-syslog.h"
void SCPluginsLoad(const char *capture_plugin_name, const char *capture_plugin_args);
SCEveFileType *SCPluginFindFileType(const char *name);
#ifndef __UTIL_POOL_THREAD_H__
#define __UTIL_POOL_THREAD_H__
+#include "util-pool.h"
+
struct PoolThreadElement_ {
SCMutex lock; /**< lock, should have low contention */
Pool *pool; /**< actual pool */
#define SCDropCaps(...)
#define SCDropMainThreadCaps(...)
#else
-#include "threadvars.h"
-#include "util-debug.h"
#include <cap-ng.h>
/**Drop the previliges of the given thread tv, based on the thread cap_flags
#include "util-byte.h"
#include "util-profiling.h"
#include "util-profiling-locks.h"
+#include "util-time.h"
#ifdef PROFILING
#include "util-byte.h"
#include "util-profiling.h"
#include "util-profiling-locks.h"
+#include "util-time.h"
#ifdef PROFILING
#include "util-byte.h"
#include "util-profiling.h"
#include "util-profiling-locks.h"
+#include "util-time.h"
#ifdef PROFILING
#include "util-byte.h"
#include "util-profiling.h"
#include "util-profiling-locks.h"
+#include "util-time.h"
#ifdef PROFILING
#ifdef PROFILING
-#include "util-profiling-locks.h"
-#include "util-cpu.h"
extern int profiling_rules_enabled;
extern int profiling_packets_enabled;
*/
#include "suricata-common.h"
+#include "suricata.h"
#include "util-random.h"
#ifndef __UTIL_ROHASH_H__
#define __UTIL_ROHASH_H__
-#include "queue.h"
typedef struct ROHashTable_ {
uint8_t locked;
#define __UTIL_SPM_BM__
#include "suricata-common.h"
-#include "suricata.h"
#define ALPHABET_SIZE 256
#define __UTIL_SPM_BS__
#include "suricata-common.h"
-#include "suricata.h"
uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint16_t);
uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint16_t);
#define __UTIL_SPM_BS2BM__
#include "suricata-common.h"
-#include "suricata.h"
#define ALPHABET_SIZE 256
#define __UTIL_SPM_H__
#include "util-spm-bs.h"
-#include "util-spm-bs2bm.h"
-#include "util-spm-bm.h"
enum {
SPM_BM, /* Boyer-Moore */
#ifndef UTIL_SYSLOG_H
#define UTIL_SYSLOG_H
+#include "util-enum.h"
+
SCEnumCharMap *SCSyslogGetFacilityMap(void);
SCEnumCharMap *SCSyslogGetLogLevelMap(void);
#ifndef __THASH_H__
#define __THASH_H__
-#include "decode.h"
-#include "util-storage.h"
/** Spinlocks or Mutex for the buckets. */
//#define HRLOCK_SPIN
#include "detect-engine-threshold.h"
#include "detect-threshold.h"
#include "detect-parse.h"
+#include "detect-engine-build.h"
#include "conf.h"
#include "util-threshold-config.h"
#endif
#include "suricata-common.h"
+#include "suricata.h"
#include "detect.h"
#include "threads.h"
#include "tm-threads.h"
#include "util-debug.h"
+#include "util-time.h"
#ifdef UNITTESTS
static struct timeval current_time = { 0, 0 };
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-sigorder.h"
+#include "detect-engine-build.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"