Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat/flowbit prefilter/v26 #12662

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+998 −175
Open

Feat/flowbit prefilter/v26 #12662

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
33bc004
flowbits: unset returns state of the bit
victorjulien Jun 10, 2022
66b6d23
flowbits: allow setter to know if set is new
victorjulien Oct 10, 2022
8ed6125
detect/flowbits: implement prefilter support
victorjulien Nov 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions src/flow-bit.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,19 +55,25 @@ static FlowBit *FlowBitGet(Flow *f, uint32_t idx)
return NULL;
}

/* add a flowbit to the flow */
static void FlowBitAdd(Flow *f, uint32_t idx)
/** \brief add a flowbit to the flow
* \retval -1 error
* \retval 0 not added, already set before
* \retval 1 added */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wonder if using an enum would be better...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adding a enum just for this func seems like overkill to me, but perhaps it makes sense explore this for a bit more generally throughout more API calls

static int FlowBitAdd(Flow *f, uint32_t idx)
{
FlowBit *fb = FlowBitGet(f, idx);
if (fb == NULL) {
fb = SCMalloc(sizeof(FlowBit));
if (unlikely(fb == NULL))
return;
return -1;

fb->type = DETECT_FLOWBITS;
fb->idx = idx;
fb->next = NULL;
GenericVarAppend(&f->flowvar, (GenericVar *)fb);
return 1;
} else {
return 0;
}
}

Expand All @@ -81,23 +87,32 @@ static void FlowBitRemove(Flow *f, uint32_t idx)
FlowBitFree(fb);
}

void FlowBitSet(Flow *f, uint32_t idx)
/** \brief add a flowbit to the flow
* \retval -1 error
* \retval 0 not added, already set before
* \retval 1 added */
int FlowBitSet(Flow *f, uint32_t idx)
{
FlowBitAdd(f, idx);
return FlowBitAdd(f, idx);
}

void FlowBitUnset(Flow *f, uint32_t idx)
{
FlowBitRemove(f, idx);
}

void FlowBitToggle(Flow *f, uint32_t idx)
/**
* \retval bool true if bit is set, false is unset
*/
bool FlowBitToggle(Flow *f, uint32_t idx)
{
FlowBit *fb = FlowBitGet(f, idx);
if (fb != NULL) {
FlowBitRemove(f, idx);
return false;
} else {
FlowBitAdd(f, idx);
return true;
}
}

Expand Down
4 changes: 2 additions & 2 deletions src/flow-bit.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,9 @@ typedef struct FlowBit_ {
void FlowBitFree(FlowBit *);
void FlowBitRegisterTests(void);

void FlowBitSet(Flow *, uint32_t);
int FlowBitSet(Flow *, uint32_t);
void FlowBitUnset(Flow *, uint32_t);
void FlowBitToggle(Flow *, uint32_t);
bool FlowBitToggle(Flow *, uint32_t);
int FlowBitIsset(Flow *, uint32_t);
int FlowBitIsnotset(Flow *, uint32_t);
#endif /* SURICATA_FLOW_BIT_H */