-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
#define DETECT_XBITS_TYPE_SET_READ 3
#define DETECT_XBITS_TYPE_SET 4
+/**
+ * \brief Different kinds of helper data that can be used by the signature
+ * ordering module. Used by the "user" field in SCSigSignatureWrapper
+ */
+typedef enum {
+ DETECT_SIGORDER_FLOWBITS,
+ DETECT_SIGORDER_FLOWVAR,
+ DETECT_SIGORDER_PKTVAR,
+ DETECT_SIGORDER_FLOWINT,
+ DETECT_SIGORDER_HOSTBITS,
+ DETECT_SIGORDER_IPPAIRBITS,
+ DETECT_SIGORDER_MAX
+} DetectSigorderUserDataType;
+
+/**
+ * \brief Signature wrapper used by signature ordering module while ordering
+ * signatures
+ */
+typedef struct SCSigSignatureWrapper_ {
+ /* the wrapped signature */
+ Signature *sig;
+
+ /* user data that is to be associated with this sigwrapper */
+ int user[DETECT_SIGORDER_MAX];
+
+ struct SCSigSignatureWrapper_ *next;
+} SCSigSignatureWrapper;
+
+/**
+ * \brief Structure holding the signature ordering function used by the
+ * signature ordering module
+ */
+typedef struct SCSigOrderFunc_ {
+ /* Pointer to the Signature Ordering function */
+ int (*SWCompare)(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2);
+
+ struct SCSigOrderFunc_ *next;
+} SCSigOrderFunc;
/**
* \brief Registers a keyword-based, signature ordering function
*/
static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_FLOWBITS] = SCSigGetFlowbitsType(sw->sig);
+ sw->user[DETECT_SIGORDER_FLOWBITS] = SCSigGetFlowbitsType(sw->sig);
}
/**
*/
static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_FLOWVAR] = SCSigGetFlowvarType(sw->sig);
+ sw->user[DETECT_SIGORDER_FLOWVAR] = SCSigGetFlowvarType(sw->sig);
}
static inline void SCSigProcessUserDataForFlowint(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_FLOWINT] = SCSigGetFlowintType(sw->sig);
+ sw->user[DETECT_SIGORDER_FLOWINT] = SCSigGetFlowintType(sw->sig);
}
/**
*/
static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_PKTVAR] = SCSigGetPktvarType(sw->sig);
+ sw->user[DETECT_SIGORDER_PKTVAR] = SCSigGetPktvarType(sw->sig);
}
/**
*/
static inline void SCSigProcessUserDataForHostbits(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_HOSTBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_HOST_BIT);
+ sw->user[DETECT_SIGORDER_HOSTBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_HOST_BIT);
}
/**
*/
static inline void SCSigProcessUserDataForIPPairbits(SCSigSignatureWrapper *sw)
{
- sw->user[SC_RADIX_USER_DATA_IPPAIRBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_IPPAIR_BIT);
+ sw->user[DETECT_SIGORDER_IPPAIRBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_IPPAIR_BIT);
}
/* Return 1 if sw1 comes before sw2 in the final list. */
static int SCSigOrderByFlowbitsCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_FLOWBITS] -
- sw2->user[SC_RADIX_USER_DATA_FLOWBITS];
+ return sw1->user[DETECT_SIGORDER_FLOWBITS] - sw2->user[DETECT_SIGORDER_FLOWBITS];
}
/**
static int SCSigOrderByFlowvarCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_FLOWVAR] -
- sw2->user[SC_RADIX_USER_DATA_FLOWVAR];
+ return sw1->user[DETECT_SIGORDER_FLOWVAR] - sw2->user[DETECT_SIGORDER_FLOWVAR];
}
/**
static int SCSigOrderByPktvarCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_PKTVAR] -
- sw2->user[SC_RADIX_USER_DATA_PKTVAR];
+ return sw1->user[DETECT_SIGORDER_PKTVAR] - sw2->user[DETECT_SIGORDER_PKTVAR];
}
static int SCSigOrderByFlowintCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_FLOWINT] -
- sw2->user[SC_RADIX_USER_DATA_FLOWINT];
+ return sw1->user[DETECT_SIGORDER_FLOWINT] - sw2->user[DETECT_SIGORDER_FLOWINT];
}
/**
static int SCSigOrderByHostbitsCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_HOSTBITS] -
- sw2->user[SC_RADIX_USER_DATA_HOSTBITS];
+ return sw1->user[DETECT_SIGORDER_HOSTBITS] - sw2->user[DETECT_SIGORDER_HOSTBITS];
}
/**
static int SCSigOrderByIPPairbitsCompare(SCSigSignatureWrapper *sw1,
SCSigSignatureWrapper *sw2)
{
- return sw1->user[SC_RADIX_USER_DATA_IPPAIRBITS] -
- sw2->user[SC_RADIX_USER_DATA_IPPAIRBITS];
+ return sw1->user[DETECT_SIGORDER_IPPAIRBITS] - sw2->user[DETECT_SIGORDER_IPPAIRBITS];
}
/**
#ifndef SURICATA_DETECT_ENGINE_SIGORDER_H
#define SURICATA_DETECT_ENGINE_SIGORDER_H
-/**
- * \brief Different kinds of helper data that can be used by the signature
- * ordering module. Used by the "user" field in SCSigSignatureWrapper
- */
-typedef enum{
- SC_RADIX_USER_DATA_FLOWBITS,
- SC_RADIX_USER_DATA_FLOWVAR,
- SC_RADIX_USER_DATA_PKTVAR,
- SC_RADIX_USER_DATA_FLOWINT,
- SC_RADIX_USER_DATA_HOSTBITS,
- SC_RADIX_USER_DATA_IPPAIRBITS,
- SC_RADIX_USER_DATA_MAX
-} SCRadixUserDataType;
-
-/**
- * \brief Signature wrapper used by signature ordering module while ordering
- * signatures
- */
-typedef struct SCSigSignatureWrapper_ {
- /* the wrapped signature */
- Signature *sig;
-
- /* user data that is to be associated with this sigwrapper */
- int user[SC_RADIX_USER_DATA_MAX];
-
- struct SCSigSignatureWrapper_ *next;
-} SCSigSignatureWrapper;
-
-/**
- * \brief Structure holding the signature ordering function used by the
- * signature ordering module
- */
-typedef struct SCSigOrderFunc_ {
- /* Pointer to the Signature Ordering function */
- int (*SWCompare)(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2);
-
- struct SCSigOrderFunc_ *next;
-} SCSigOrderFunc;
-
void SCSigOrderSignatures(DetectEngineCtx *);
void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *);
void SCSigRegisterSignatureOrderingTests(void);